Julian Norton

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

Thrilled to have the opportunity to analyze #vulnerability remediation timelines again, this time using data from NopSec. The chart below is based on a survival analysis of vulnerabilities across an environment. Essentially - the time it takes to remediate all affected assets after a vuln is discovered. Everytime I see analysis like this, I'm reminded of how different the real world of #vulnerabilitymanagement is from the "just patch it all yesterday" shallow advice that's so often bandied about. If it were that easy, vuln survival curves wouldn't look like this time after time. How does this square with your experience? I'll be discussing this chart and several others in a webinar next week. Register here and bring your questions, comments, and rants! https://lnkd.in/eHWDrEYN

92

26 Comments

If your Cyber Supply Chain Risk program is not supported by technical risk teams, your program is probably a useless checkbox. The reality is supply chain risk management, and yes, cyber SCRM, touches every aspect of the business. Not just cyber. Because it requires an all-of-business change in how we procure, implement and operate technology. But I see a lot of programs spun up out of the procurement group or a compliance function without truly understanding the risks they are tasked with managing. Will your SCRM team know how to read and validate a network security architecture diagram? Will they understand what a good disaster recovery plan looks like? What about that critical API your business depends on and how they provision high availability for that? What about the actions YOU need to take? For instance, testing software updates before deploying into production. Or do you trust them because you did a vendor assessment 8 months ago? C-SCRM might have more wasted investment than any other area in modern cybersecurity programs. There's a reason many CISO's struggle to derive value from the spend. But it's not because it's not useful. You are just doing it wrong. Rethink your approach, stop doing what everyone else is doing and use some common sense. The scale of the problem is massive and you probably have the wrong people doing the work in the wrong areas. Start with a solid Business Continuity Plan (BCP), understand the business risks and identify your most critical dependencies. Who in your organization understands how these work? These are the folks that need to be part of the conversation, not only non technical people executing a toothless assessment program. Do some threat modeling and do not forget to model the accidental vectors (like broken software updates and human error). What are your opportunities to reduce the risk? You won't be able to fix everything, but maybe there are places you need to plan for and train on manual process or implement additional mitigating controls. Some may be vendor-supplied controls, some are things you will need to handle yourself. It is quite likely that exercising your BCP/DR/IR plans is the most reasonable approach to deal with these concerns. Questionnaires and assessments might be part of the solution, but ask yourself if your process is actually helping reduce risk in your program. Or is it just noise? #cybersecurity #scrm #supplychainrisk #businesscontinuity #bcp #criticalfunctions

20

8 Comments

NJ Cops Are Suing To Protect Their Exclusive Right To Keep Their Data Out Of Data Brokers’ Databases https://lnkd.in/d3chJMxZ

2

NJ Cops Are Suing To Protect Their Exclusive Right To Keep Their Data Out Of Data Brokers’ Databases https://lnkd.in/d3chJMxZ

2

My colleague Denny Wan provides a great use case for Cyber Risk Quantification as an enabler for AI value development, as well as, a powerful tool for defending against legal threats that could slow down AI utilization.

1

1 Comment

Crowdstrike has already admitted fault for its faulty update which caused a widespread tech outage. Now, Delta Airlines claims enormous losses of $500M due to the Crowdstrike disruption and has hired a high profile attorney to go after Crowdstrike for damages. While there were widespread issues across multiple companies, Delta is clearly outlier in the extent and size of damages. That leads to the question, is the size of the problem due to Crowdstrike, or Delta’s inability to respond to the problem adequately. Even among airlines most were able to recover with far less impact. Does Delta have a case, or were they just so inadequately prepared that the fault lies with them? As an aside, one review of a Crowdstrike indicates that their limitation of liability is capped at the size of the contract. #techoutage #crowdstrike #cyber #cybersecurity https://lnkd.in/e7sFdscy

19

9 Comments

🔍 Technical Dive: The Critical Importance of Comparison Operators in Smart Contract Security Inspired from a conversation on X, i thought i'd write an elaborated post here. At Olympix, we keep encountering a subtle yet potentially dangerous pattern: the misuse of comparison operators, specifically '>' vs '>=' in boundary conditions. Let me break down why this seemingly minor detail matters significantly in Web3 security. 🔍 The Security Implications: 1️⃣ Edge Case Exclusion: When using '>', you're inadvertently excluding the exact boundary value. In DeFi protocols, this can lock funds permanently when amount equals minWithdrawalLimit, despite it being a valid state. 2️⃣ State Machine Transitions: In protocols with state transitions based on thresholds (like liquidation conditions), '>' instead of '>=' can create a "dead zone" where neither state is valid, breaking protocol invariants. 3️⃣ Example: A DEX implementation where LP removal was blocked when remaining liquidity exactly matched the minimum threshold - funds essentially locked due to a single comparison operator. 🛠️ Impact Assessment: Best case: User inconvenience requiring additional transactions. Worst case: Permanent fund locking or broken protocol state machines. Common severity: Low to Medium. Escalates to High when combined with precision loss in fixed-point math. 💡 Mitigation Strategy: Always question boundary conditions. Document explicit reasoning for choosing '>' over '>=' Add comprehensive test cases for exact boundary values. Consider fuzzing tests specifically targeting boundary conditions. 👉 The Rule of Thumb: Default to '>=' unless you have an explicit, documented reason for excluding the boundary value. Your future self (and auditors) will thank you.

8

Interesting to see that not only is this company being sued for allegedly violating Texas' data privacy law, but as part of this lawsuit, it was alleged that the data broker in question did not register as a data broker in Texas [full disclosure: this is a law - SB 2105 - that I was an advisor on]. It should also be noted that the same company appears not to be registered in California as a data broker.

16

2 Comments

💡 How does my PKI’s status compare to that of others? Understanding where your Public Key Infrastructure (PKI) stands compared to others can be a game-changer. It’s not just about identifying benchmarks and best practices but also uncovering areas ripe for improvement. 🌟 While it’s crucial to tailor your PKI evaluation to fit your organization’s unique needs and constraints, benchmarking against industry reports, case studies, and peer-reviewed publications can offer invaluable insights into your PKI’s performance. 📊✨ Though the PKI Consortium doesn’t publish individual maturity assessment results, we provide a vibrant community where you can exchange experiences and learn from others. Join our working groups and tap into a wealth of shared knowledge! 🤝🌐 Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium

13

Managing #thirdparty #cyberrisk is hard. But it gets even harder when trying to manage 4th...5th...Nth tier #supplychain relationships because visibility, familiarity, and control tend to decline with each degree of removal. This chart, from a joint Cyentia Institute and RiskRecon, A Mastercard Company report, captures this challenge. Your organization (the square in the center) may be able to track breaches of your direct third parties. But what about all those others? Are you even aware that you're indirectly connected to - and thereby potentially exposed to - breaches of those Nth parties? We explore this topic in "Risk to the Nth-Party Degree." Link to download in comments.

239

35 Comments

The Consumer Financial Protection Bureau has proposed a new rule (https://lnkd.in/giuxe2n9) to limit the hugely grey area that Data Brokers operate within. Glad this is getting news coverage, it's long overdue. #CFPB #DataPrivacy #ConsumerProtection #DataSecurity #PrivacyLaw #Cybersecurity

6

🚨 Case Study Alert: How DigiCert Traced Incident Breadcrumbs for Swift Resolution 🚨 Explore how rapid threat detection and remediation can make the difference between a minor issue and a major breach. See the full story and how WireX Systems' advanced tools helped DigiCert react in minutes. #CyberSecurity #ThreatRemediation #IncidentResponse #WireXSystems #DigiCert"

3

CMMC Level 2 Assessment Objective: Data in Transit PRACTICE: Organizations must implement cryptographic mechanisms to prevent unauthorized disclosure of controlled unclassified information (CUI) during transmission unless otherwise protected by alternative physical safeguards. ASSESSMENT: The intent of this requirement is to ensure CUI is cryptographically protected during transit, particularly on the internet. The most common way to accomplish this is to establish a transport layer security (TLS) tunnel between the source and destination using the most current version of TLS. Because the use of cryptography in this requirement is to protect the confidentiality of CUI, the cryptography used must meet the criteria specified in requirement SC.L2-3.13.11. Be prepared! Your assessor could ask to 🔍 EXAMINE system and communications protection policy. 🗣 INTERVIEW system or network administrators. 📝 TEST cryptographic mechanisms or mechanisms supporting or implementing transmission confidentiality. (CMMC Assessment Guide: Level 2 Version 2.11, page 222) #CMMC #DoD #cybersecurity #NIST #InformationSecurity https://bit.ly/45HMpUs

41

⚠ Areas of Overlap and Gaps between AICPA SOC2 Trust Services Criteria (TSC) and ISO 42001 - PART 2⚠ -Questions for Realistic Controls Cross Mapping- ❓ Scoping 1. What are the specific AI systems and components within the organization’s scope? 2. What are the boundaries and applicability of the AI management system within the organization? 3. What external and internal issues are relevant to the organization's AI systems? ❓TSCs Included in Scope 1. Which TSC criteria are relevant to the AI systems? (Security, Availability, Processing Integrity, Confidentiality, Privacy) 2. How do the TSC criteria map to the specific AI controls and requirements in ISO 42001? ❓Detailed Cross Mapping Questions 1. Governance and Accountability: ◾How does the organization’s governance structure ensure accountability for AI systems (ISO 42001, Clause 5.1 and AICPA TSC, Common Criteria)? ◾What roles and responsibilities are defined for AI systems, and how do they align with TSC criteria? 2. Risk Management: ◾How are AI risks identified, assessed, and mitigated (ISO 42001, Clause 6.1.2, 6.1.3 and AICPA TSC, Risk Assessment and Mitigation)? ◾How are AI impact assessments integrated into the risk management process? 3. Security and Confidentiality: ◾What controls are in place to ensure the security and confidentiality of AI systems (ISO 42001, Annex A controls and AICPA TSC, Security, Confidentiality)? ◾How is the integrity of AI data and systems maintained? 4. Monitoring and Evaluation: ◾What monitoring and evaluation processes are in place for AI systems (ISO 42001, Clause 9.1 and AICPA TSC, Monitoring of Controls)? ◾How are performance and effectiveness of AI systems measured and reported? 5. Ethics and Fairness: ◾What measures are in place to ensure ethical use and fairness of AI systems (ISO 42001, Annex A controls)? ◾How are bias and ethical considerations integrated into AI system development and deployment? 6. Documentation and Communication: ◾What documentation is maintained for AI systems (ISO 42001, Clause 7.5.1 and AICPA TSC, Information and Communication)? ◾How are AI policies, procedures, and impact assessments documented and communicated? For those of you who currently carry SOC2 attestation that are considering pursuing ISO42001 certification, please know that while the frameworks don't necessarily directly align, you will find ways to repurpose existing controls (administrative and technical) if you ask the right questions in context. As always, if you need help getting started, please reach out! A-LIGN #AICPA #SOC2 #ISO42001 #TheBusinessofCompliance #ComplianceAlignedtoYou

14

4 Comments

GodFather: the malware you can't refuse "Cyble Research and Intelligence Labs (CRIL) has identified a new variant of the GodFather malware, now targeting 500 banking and cryptocurrency apps. Initially focused on regions like the UK, US, Turkey, Spain, and Italy, GodFather has expanded its reach to include Japan, Singapore, Greece, and Azerbaijan. The GodFather malware has transitioned the Java code implementation to the Native code for its malicious activities. In its latest version, the GodFather malware uses limited permissions, relying heavily on Accessibility services to capture credentials from targeted applications. This updated variant also includes new commands that enable the malware to automate gestures on infected devices, mimicking user actions. The Threat Actor(TA) behind GodFather malware uses a phishing site to deliver the suspicious app and tracks visitor counts to plan further activity."

1

Getting ready to lead discussions in Boston this week. Come join to talk about supply chain attacks - think about all your devices, not just software - and better security testing in your software development lifecycle.

4

I’ve been telling folks for years to prepare for DPIAs to become public one way or another. It’s not a secret filing. Shrewd privacy and communication professionals will recognize the opportunity to counsel organizations on how to stop creating & hiding skeletons in the closet. Because when DPIAs become public, everyone will know what you know, including: - how honest & thorough you were from the jump (or did it take 5 versions to meet the requirements?) - known risks you haven’t told them about yet - how transparent you are with regulators - how you evaluate tradeoffs - if you have command of both technical & legal controls

5

🔒 Ransomware strikes again, and the CISO is shown the door. Is this fair?   Finding someone to blame doesn't help to improve any organization's security posture. Let’s work to make this industry more collaborative and transparent, working together to mitigate vulnerabilities before attackers exploit them. So, what can you do? 1. Use security validation tools to continuously test security posture to enhance an organization’s resilience against attacks.  2. Communicate risks with Stakeholders to balance business needs against security needs. 3. Agree on a risk mobilization plan and operational service level agreement, to consistently improve posure. Pentera #cybersecurity

35