Mani Keerthi N

Our #massdatagov recently commented on the Cybersecurity and Infrastructure Security Agency #CIRCIA #cybersecurity reporting requirements NPRM including suggestions around reporting requirements for incidents at third party organizations #security #MHDCregulatory Read our comment here: https://ow.ly/JRRW50SiqLG

3

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

"OSCs must retain artifacts used as evidence for the assessment for the duration of the validity period of the certificate of assessment, and at minimum, for six years from the date of certification assessment as addressed in 32 CFR 170.17(c)(4). The OSC is responsible for compiling relevant artifacts as evidence and having knowledgeable personnel available during the assessment. The organizational artifacts are proprietary to the OSC and will not be retained by the assessment team unless expressly permitted by the OSC. To preserve the integrity of the artifacts reviewed, the OSC creates a hash of assessment evidence (to include a list of the artifact names, the return values of the hashing algorithm, and the hashing algorithm used) and retains the artifact information for six years. The information obtained from the artifacts is an information collection and is provided to the C3PAO for uploading into the CMMC instantiation of eMASS." The above text is from the DoD's June 21, 2024 submission to the Federal Register. It describes the expected information collection level-of-effort for a CMMC Level 2 assessment. Some more information: The DoD expects evidence collection and archival, assessment planning and results, C3PAO records about their assessment staff, and submission of data into CMMC eMASS to take 525 hours on average, per assessed company. This is just the effort related to paperwork. It doesn't cover the time spent interviewing or demonstrating the system. It doesn't cover the time preparing. Bottom line? The DoD seems 𝒅𝒆𝒕𝒆𝒓𝒎𝒊𝒏𝒆𝒅 to get their defense contractors cyber-secure, no matter the cost. They are treating this as seriously as the defenses for our key military and government installations, and looking at a timeline of just a few years to get our manufacturing and military support base resilient to cyber-attack. If you're ready to start working seriously on NIST SP 800-171 and #CMMC compliance, or want to get scheduled for your certification assessment, give my team at Kieri Solutions - Authorized C3PAO a call. We specialize in helping companies become compliant without outsourcing their control of IT to a third party. Read more about the DoD's submission below: https://lnkd.in/eTFi9dVK

51

47 Comments

Thrilled to have the opportunity to analyze #vulnerability remediation timelines again, this time using data from NopSec. The chart below is based on a survival analysis of vulnerabilities across an environment. Essentially - the time it takes to remediate all affected assets after a vuln is discovered. Everytime I see analysis like this, I'm reminded of how different the real world of #vulnerabilitymanagement is from the "just patch it all yesterday" shallow advice that's so often bandied about. If it were that easy, vuln survival curves wouldn't look like this time after time. How does this square with your experience? I'll be discussing this chart and several others in a webinar next week. Register here and bring your questions, comments, and rants! https://lnkd.in/eHWDrEYN

92

26 Comments

We did something new (for us) in the latest edition of the Information Risk Insights Study (IRIS) that focuses on #ransomware - we projected financial losses. Normally, we restrict ourselves to known publicly-reported losses. But in this case, we felt that wouldn't do proper justice to the true impact of ransomware on the economy. But don’t worry—we didn't abandon our core principles and ride the trolley into the Neighborhood of Make-Believe. We took the data we had on ransomware losses over the last five years, fit a distribution, and then applied properly sampled values to incidents that had no loss info on public record. Using this method, we calculate the total financial losses from publicly known ransomware incidents over the last five years to be about $274 billion dollars. How does that fit with your intuition or analysis? Too high? Too low #cyberrisk #cyberattacks Read the full report, sponsored by CISA, here: https://lnkd.in/eWEnwj8n

91

7 Comments

National Institute of Standards and Technology (NIST)  has released the RMF Small Enterprise Quick Start Guide. For organizations of all sizes, managing risk (including information security and privacy risk), is critical for organizational resilience. This guide is designed to help small, under-resourced entities understand the value and core components of the NIST Risk Management Framework (RMF) and provide a starting point for designing and implementing an information security and privacy risk management program. This document is not intended to replace the RMF; it is intended to be an introductory guide to help organizations get started. Link: https://lnkd.in/deZ9csya PDF Source: https://lnkd.in/dJaetyYx #NIST #dataprivacy #RMF #cybsersecurity #risk

1

Ransomware Attack on UMC Disrupts Emergency Services UMC Health System in Lubbock, Texas, faced a ransomware attack, forcing it to divert emergency patients. The attack disrupted IT infrastructure, phone systems, and patient portals. UMC remains open, but select patients are still being diverted while services are being restored. John Riggi from the American Hospital Association called it a national security issue, warning that cyberattacks on trauma centers risk lives. Experts like Emily Phelps from Cyware highlight the need for proactive defense through collaborative intelligence to prevent future disruptions. #Cybersecurity #Healthcare #Ransomware #UMC #PatientCare https://lnkd.in/d4gNVTea

37

1 Comment

If you want to install the risk mindset, read these books: Links to the standards and publications can be found in my latest article. ________ Enjoy this? Join 7K+ in GRC Lab — my free newsletter to help you launch, grow and accelerate your career in GRC:

56

3 Comments

Follow the DVMS Institute for exciting announcements on "HOW" organizations of any Size, Scale, or Complexity can Operationalize a NIST Cybersecurity Framework Digital Value Management System™ capable of delivering the Trusted, Resilient, and Auditable digital outcomes government auditors expect

16

The latest National Association of State Chief Information Officers (NASCIO) report shows State cybersecurity budgets are on the rise, but are they growing fast enough to keep up with the evolving threat landscape? The report surveyed state CISOs from all 50 states and the District of Columbia, and focused on five areas: the expanding role of the state CISO, generative AI, inadequate cybersecurity budgets, growing cyber threats and building stronger cybersecurity workforces. “The attack surface is expanding, with the public sector’s reliance on information becoming increasingly central to the operation of government itself,” the report states. “The ability of government to deliver on its mission rests on data—and on the security of that data.” Yet many state IT leaders believe their 2024 budgets remain inadequate, particularly as they face challenges related to staffing shortages, an expanding attack surface, and the increasing threat of ransomware, driven by double-extortion attacks, where criminals both steal and encrypt data. This adds further pressure, making it crucial to bolster cybersecurity defenses while managing it all with limited resources. Are we adequately securing critical infrastructure, or are we heading towards failure? Dig deeper on this topic at: https://lnkd.in/edSkcMxw

35

7 Comments

If you’re at the Zywave Cyber Risk Insights conference today, look for me! I’ll be joining a panel at 1:45 to discuss whether we’ve reached a critical mass yet with data to adequately model and manage #cyberrisk. https://lnkd.in/dK2d3HHe

13

1 Comment

Where should we focus the IRIS next? You decide! The Information Risk Insights Study (IRIS) research series from the Cyentia Institute aims to provide rigorous analysis to support organizations in assessing and managing cyber risk. https://lnkd.in/e_BGmwT Over the years, we've examined the overall frequency and financial losses from security incidents, compared those metrics across different sectors and org sizes, conducted in-depth study of the 100 largest cyber loss events, researched massive multi-party incidents, and focused on particular threats (e.g., ransomware). We generally select topics to cover in the IRIS based on community interest and availability of sponsorship funds. So - back to the question at the beginning of this post. What would you like to see the IRIS focus on next? Are there vendors, gov agencies, or other organizations out there interested in sponsoring an IRIS on particular topics? Let us know! #cyberrisk #cybersecurity #cyberattacks

5

Great sharing by Robert M. Lee. CIO/CISOs stop hiding cyber risk. It is an enterprise risk that requires executive attention.

8

CMMC Level 2 Assessment Objective: Alternative Work Sites PRACTICE: Organizations must enforce safeguarding measures for containing controlled unclassified information (CUI) at alternative work sites. ASSESSMENT: Alternative work sites may include government facilities or the private residences of employees. Organizations must define and implement safeguards to account for protection of CUI beyond the enterprise perimeter. Safeguards may include physical protections, such as locked file drawers, as well as electronic protections such as encryption, audit logging, and proper access controls. Be prepared! Your assessor could ask to: 🔍 EXAMINE a list of safeguards required for alternative work sites 🗣 INTERVIEW personnel approving use of alternative work sites 📝 TEST organizational processes for security at alternative work sites (CMMC Assessment Guide: Level 2 Version 2.11, page 186) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

47

🚨 Data Breach Alert: Major U.S. Hospital System Hacked Texas Tech University Health Sciences Center, and Texas Tech University Health Sciences Center El Paso (HSCs) confirm ransomware attack. Another alarming cybersecurity breach has struck a major U.S. hospital, exposing the personal data of 1.4 million patients. This incident highlights the critical vulnerabilities in healthcare systems and the urgent need for stronger cybersecurity measures. In a sector that handles sensitive patient data daily, these breaches not only compromise privacy but also erode trust in healthcare institutions. It’s a stark reminder for organizations to invest in proactive security strategies and robust data protection frameworks. Protecting patient data is not just an IT issue—it’s a matter of public trust and safety. Read more about the breach https://lnkd.in/g3ptHkq4 How can we ensure better safeguards for healthcare data? Let’s discuss! 👇 #Cybersecurity #DataPrivacy #HealthcareSecurity #PatientTrust Contact us below to see how we can develop a web 3 solution that is right for you. #Didgebridge #Intellismart #HealthcareMarketing #Marketing Strategy Learn more visit: https://didgebridge.com Text: dbvideo To: 855.426.7770 Like, Share and Follow these posts for more content like this. 𝘉𝘺 𝘵𝘦𝘹𝘵𝘪𝘯𝘨 𝘵𝘩𝘦 𝘬𝘦𝘺𝘸𝘰𝘳𝘥 𝘺𝘰𝘶 𝘢𝘳𝘦 𝘨𝘪𝘷𝘪𝘯𝘨 𝘤𝘰𝘯𝘴𝘦𝘯𝘵 𝘵𝘰 𝘰𝘱𝘵-𝘪𝘯 𝘢𝘯𝘥 𝘴𝘶𝘣𝘴𝘤𝘳𝘪𝘣𝘦 𝘵𝘰 𝘳𝘦𝘤𝘦𝘪𝘷𝘪𝘯𝘨 𝘚𝘔𝘚 𝘵𝘦𝘹𝘵 𝘮𝘦𝘴𝘴𝘢𝘨𝘦𝘴 𝘳𝘦𝘱𝘭𝘺 𝘚𝘵𝘰𝘱 𝘵𝘰 𝘰𝘱𝘵-𝘰𝘶𝘵. 𝘞𝘦 𝘥𝘰 𝘯𝘰𝘵 𝘴𝘩𝘢𝘳𝘦 𝘺𝘰𝘶𝘳 𝘥𝘢𝘵𝘢 𝘸𝘪𝘵𝘩 3𝘳𝘥 𝘱𝘢𝘳𝘵𝘪𝘦𝘴.

2

⚠ Areas of Overlap and Gaps between AICPA SOC2 Trust Services Criteria (TSC) and ISO 42001 - PART 2⚠ -Questions for Realistic Controls Cross Mapping- ❓ Scoping 1. What are the specific AI systems and components within the organization’s scope? 2. What are the boundaries and applicability of the AI management system within the organization? 3. What external and internal issues are relevant to the organization's AI systems? ❓TSCs Included in Scope 1. Which TSC criteria are relevant to the AI systems? (Security, Availability, Processing Integrity, Confidentiality, Privacy) 2. How do the TSC criteria map to the specific AI controls and requirements in ISO 42001? ❓Detailed Cross Mapping Questions 1. Governance and Accountability: ◾How does the organization’s governance structure ensure accountability for AI systems (ISO 42001, Clause 5.1 and AICPA TSC, Common Criteria)? ◾What roles and responsibilities are defined for AI systems, and how do they align with TSC criteria? 2. Risk Management: ◾How are AI risks identified, assessed, and mitigated (ISO 42001, Clause 6.1.2, 6.1.3 and AICPA TSC, Risk Assessment and Mitigation)? ◾How are AI impact assessments integrated into the risk management process? 3. Security and Confidentiality: ◾What controls are in place to ensure the security and confidentiality of AI systems (ISO 42001, Annex A controls and AICPA TSC, Security, Confidentiality)? ◾How is the integrity of AI data and systems maintained? 4. Monitoring and Evaluation: ◾What monitoring and evaluation processes are in place for AI systems (ISO 42001, Clause 9.1 and AICPA TSC, Monitoring of Controls)? ◾How are performance and effectiveness of AI systems measured and reported? 5. Ethics and Fairness: ◾What measures are in place to ensure ethical use and fairness of AI systems (ISO 42001, Annex A controls)? ◾How are bias and ethical considerations integrated into AI system development and deployment? 6. Documentation and Communication: ◾What documentation is maintained for AI systems (ISO 42001, Clause 7.5.1 and AICPA TSC, Information and Communication)? ◾How are AI policies, procedures, and impact assessments documented and communicated? For those of you who currently carry SOC2 attestation that are considering pursuing ISO42001 certification, please know that while the frameworks don't necessarily directly align, you will find ways to repurpose existing controls (administrative and technical) if you ask the right questions in context. As always, if you need help getting started, please reach out! A-LIGN #AICPA #SOC2 #ISO42001 #TheBusinessofCompliance #ComplianceAlignedtoYou

14

4 Comments

"(b) Requirements. The Contractor shall— (1)(i) Have a current CMMC certificate or current CMMC self-assessment at the following 𝐂𝐌𝐌𝐂 𝐥𝐞𝐯𝐞𝐥, 𝐨𝐫 𝐡𝐢𝐠𝐡𝐞𝐫: __________ [Contracting Officer to fill in the required CMMC level]; and ... (2) Maintain the CMMC level required by this contract for the duration of the contract for all information systems, used in performance of the contract, that process, store, or transmit 𝐅𝐞𝐝𝐞𝐫𝐚𝐥 𝐜𝐨𝐧𝐭𝐫𝐚𝐜𝐭 𝐢𝐧𝐟𝐨𝐫𝐦𝐚𝐭𝐢𝐨𝐧 (𝐅𝐂𝐈) 𝐨𝐫 𝐜𝐨𝐧𝐭𝐫𝐨𝐥𝐥𝐞𝐝 𝐮𝐧𝐜𝐥𝐚𝐬𝐬𝐢𝐟𝐢𝐞𝐝 𝐢𝐧𝐟𝐨𝐫𝐦𝐚𝐭𝐢𝐨𝐧 (𝐂𝐔𝐈); (3) Only process, store, or transmit data on information systems that have a CMMC certificate or CMMC self-assessment 𝐚𝐭 𝐭𝐡𝐞 𝐂𝐌𝐌𝐂 𝐥𝐞𝐯𝐞𝐥 𝐫𝐞𝐪𝐮𝐢𝐫𝐞𝐝 𝐛𝐲 𝐭𝐡𝐞 𝐜𝐨𝐧𝐭𝐫𝐚𝐜𝐭, 𝐨𝐫 𝐡𝐢𝐠𝐡𝐞𝐫;" ----------- This is from the proposed 48CFR #CMMC Rule. The text above would be placed into contracts as CMMC rolls out (unless modified in response to comments). Do you see the problem with the wording? If the contracting officer fills in "Have a current CMMC certificate or current CMMC self-assessment at the following CMMC Level, or higher: 𝐂𝐌𝐌𝐂 𝐋𝐞𝐯𝐞𝐥 2"... then (2) and (3) essentially say that the contractor will keep 𝐚𝐥𝐥 𝐝𝐚𝐭𝐚 related to the contract (𝐢𝐧𝐜𝐥𝐮𝐝𝐢𝐧𝐠 𝐅𝐂𝐈) on a CMMC Level 2 system. Is it a mistake? I hope so. The language goes against all verbal explanations given so far by the DoD. Remember, all this time, they've been saying that a CMMC Level 1 system is for FCI, and a CMMC Level 2+ system is for CUI. I would have expected language like "will maintain CMMC Level 1 on all systems that store, process, or transmit FCI, and will maintain CMMC Level ___(2 or 3)__ on all systems that store, process, or transmit CUI for this contract." If the DoD does plan to go forward with that language, it poses a major problem for companies that plan to build a VDI enclave to handle CUI while keeping FCI on their main corporate system (with a Level 1 self-assessment). I don't see any instruction to C3PAOs to verify the location of FCI during CMMC Level 2 assessments however. So dishonest companies would be able to self-attest that all of the FCI related to the contract is kept in the CMMC Level 2 system without worrying about a private sector assessor snooping around. Credit to Vincent Scott for pointing out this problem a few days ago. Want to read the rule yourself? It is published in the Federal Register here: https://lnkd.in/eUbKc8BH The DoD is accepting comments until 10/15/2024. ------ Kieri Solutions - Authorized C3PAO offers CMMC Level 2 assessments and preparation services.

24

10 Comments