Andrew LeMasters

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

Navigating the #cybersecurity world can feel like deciphering a secret code. EDR? MDR? Join Huntress as we demystify these terms and explore the best solutions for your organization, without the technical jargon.

4

Prime contractors are urgently asking subs: When do you plan to get your #CMMC Level 2 Certification? The time to act is now. 👉 Reserve your spot for the early CMMC Certification Assessment today. 💡 𝗪𝗵𝘆 𝗻𝗼𝘄? ☝ - When #DoD includes CMMC Level 2 Certification requirements in a contract, 𝘿𝙤𝘿 𝙚𝙭𝙥𝙚𝙘𝙩𝙨 𝙘𝙤𝙣𝙩𝙧𝙖𝙘𝙩𝙤𝙧𝙨 𝙩𝙤 𝙤𝙗𝙩𝙖𝙞𝙣 𝙩𝙝𝙚 𝘾𝙈𝙈𝘾 𝘾𝙚𝙧𝙩𝙞𝙛𝙞𝙘𝙖𝙩𝙞𝙤𝙣 𝙗𝙮 𝙩𝙝𝙚 𝙘𝙤𝙣𝙩𝙧𝙖𝙘𝙩 𝙖𝙬𝙖𝙧𝙙 𝙙𝙖𝙩𝙚. This includes subcontractors. ✌ - Avoid the mad rush! - Thousands of Defense contractors (Prime and Subs) will need to get the CMMC certification, while there are only 54 C3PAOs. ⏰ Based on the #CMMC rulemaking schedule, the CMMC Certification Assessment will start by the end of 2024 or the beginning of 2025. ✔ As the Joint Surveillance Voluntary Assessment (#JSVA) window closes, more #DIB organizations have reserved their spots in the queue. ❗ Act fast. We are taking reservations now. klcconsulting.net/contact KLC Consulting - Authorized CMMC C3PAO

13

API keys are essential to connect applications, services, or data lakes together. Yet, they can also be a security risk. Imagine Alice sets up an API key to give her team or a vendor access to sensitive data—many times these keys are long-lived and often shared across different workloads. If the group uses federation, actions taken by Alice or others occur using a shared credential/role in the environment. This means logs would only show the credential conducting that activity, which again, gets shared with others who have access to the role. Alice's coworker, Bob, has their legitimate cloud credentials compromised. The threat actor uses Bob's credentials to federate into a shared credential/role in the environment. The threat actor exploits native features/functions of the cloud to appear as Bob, thereby blending their activity in to avoid detection. Most security teams today won't spot Bob's impersonator fast enough or at all. Trying to make sense of cloud logs is a real challenge, especially when it's happening in real-time. It can take hours or even days to piece together what happened. And by then, detection and response are delayed and the damage might already be done. What can you do? Security teams can start by keeping a detailed record of all identities, keys, tokens, certificates, and credentials they've provisioned and used, services accounts they have access to, what roles they assume. Then, security teams can set up what's considered "normal" access and behavior. Once the team understands “normal” behavior, they can develop rules and alerts from logs to try to detect and respond to access and behavioral anomalies. At Permiso, we have developed an identity-centric approach to cloud threat detection and response. Our solution can help security teams detect and respond to access and behavioral anomalies in the environments faster and with greater confidence from having the full session access and activity. Want to learn more? DM me or visit https://lnkd.in/gC4DUJ9j to learn about our approach to solving the challenge of detecting and responding to threats in and across IaaS, SaaS, CI-CD, IDP environments.

11

In a constantly evolving #ThreatLandscape, your best defense is preparedness and awareness. 🧠 Unlock expert insights to manage #CyberRisk in this #Optiv LinkedIn Live discussion – watch now: https://dy.si/Vy64uT

2

Ask the CCP: CMMC Time Enigma So, I have been “counting the days”…. Let me dwell on that but on a slightly different perspective…. It is late 2024 and we still do not have a definitive date or even a definitive timeline for CMMC version 2 and the first two timeline Phase 1 (mandates Level 1 controls) and Phase 2 (all controls) periods. The preparation period to at least internally verify the level of compliance to CMMC version 2 can take anywhere from 1 to 6 months or even 9 to 12 months for larger organizations. Therefore, it must be assumed that an Organization MUST allow at least a 6 month advance preparation before going to CMMC version 2, Phase 1 beginning at the upcoming Effective Date 🤔 How to deal with all this UNCERTAINTY?? I BRING THE ULTIMATE COMPETITIVE ADVANTAGE:     TARDIS[1] I also have this associate, known galactically as “The Doctor”[2] 👨‍⚕️. Not Doctor Spock (who is unrelated to Mr. Spock 🖖 to clarify), nor Doctor Doom nor Doctor Strange. Well, as a result of this, you may ask: “DOCTOR WHO?!?”     Of Course, The Answer Is Definitively “YES!”. YES WHO? (you may ask)     Of Course, Are You Not Following This? OK, FORGET THE DOCTOR - SO WHO IS GOING TO ENSURE MY ORGANIZATION ACHIEVES CMMC?     Yes - The Doctor[2]. SO, WHO IS THE DOCTOR?     Right, Exactly! I’ll prepare you when he’ll participate so you know Who is on First…. 😆 So, if you need CMMC preparation guidance, contact me, The CCP. Myself and associates, like the Doctor[2], can predict (and postdict) your CMMC success. With the use of TARDIS[1] Allons y! 🥐 #CMMCv2 #assessments #CMMCv2-phase1 #CMMCv2-phase2 [1] TARDIS (Threat_Assessment-Risk_Determination-Information_Security) can move through time and relatively distance in streaming meetings to preemptively solve your CMMC POA&Ms, regardless of Effective Date. [2] the presence and timely participation of the Doctor cannot be predicted or assured, but you will get no less than “The Doctor Who of CMMC”

1

Get ready for CMMC 2.0 in December. Even if your organization is not providing products or services to the United States Department of Defense, it's worth reviewing CMMC to see where you are and how you can mature your cybersecurity program. https://lnkd.in/dSk4KcQg #cybersecurity #infosec #DoD #CMMC

1

With the National Security Agency's backing, it's clear: segmenting your network enhances security. While it may seem daunting, success lies in smart planning and aligning with your business goals. Embrace the opportunity to bolster your defenses! #Cybersecurity #Microsegmentation #NSA #BeBreachReady https://lnkd.in/gbb2kkZe

10

Thoughts on Just-In-Time procedures and NIST SP 800-171 / #CMMC compliance... At Kieri Solutions - Authorized C3PAO , we figured out that people follow procedures best when they 𝘢𝘳𝘦𝘯'𝘵 𝘱𝘳𝘰𝘤𝘦𝘥𝘶𝘳𝘦𝘴. ??? Let me explain. You're onboarding a new user. To be compliant with #CMMC, your onboarding team needs to go through a convoluted process involving getting details about the new user, verifying NDA, background checks, training, requesting permissions, justifying permissions, reviewing permissions, authorizing permissions, creating accounts, creating records of the accounts, creating records of the permissions for the accounts, assigning expiration dates for each account, setting up a laptop, authorizing the laptop...!!! It goes on and on. If your strategy is to tell your HR and IT team that they need to perfectly follow a 70 step process on page 19 of ye old 𝐈𝐓_𝐏𝐫𝐨𝐜𝐞𝐝𝐮𝐫𝐞𝐬_𝐌𝐚𝐧𝐮𝐚𝐥, 𝘺𝘰𝘶 𝘮𝘪𝘨𝘩𝘵 𝘢𝘴 𝘸𝘦𝘭𝘭 𝘱𝘢𝘤𝘬 𝘶𝘱 𝘺𝘰𝘶𝘳 𝘣𝘢𝘨𝘴 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸. The error rate will be upwards of 80%, unless you nag and threaten 😡 everyone constantly, in which case you might get down to an error rate of 30% (and your team will quit). Instead, if you use a combination of a well-designed Access Request Form and an Account Management database, all your team needs to do is remember to start with the correct form. 📝 The form should have fields and just-in-time instructions for each step of the process between HR and your IT Department. All your team needs to do is fill out each field in the form and they will complete the background screening, training, permissions, justifications, etc. naturally without nagging. Then, a well designed Account Management database helps your team manage the accounts long-term by including checks ◻️ for commonly-forgotten steps (like user agreements), next-review dates, annual training refresher dates, mapping the user to their supervisor, granular "should-be" permissions for both digital systems and facilities, and historic authorization notes. The last step for perfect procedures is a regular review to look for and fix errors. But again, if you want to be successful, don't expect your team to remember your dusty policies and procedures book in the corner. Instead, use a scheduled task, a ticket, or a checklist with just-in-time instructions to make sure that the review gets done. Pro-tip: next-review-dates are an excellent way to spread this task across time, instead of trying to do it all in one lump. Are your compliance policies and processes working for you, or against you? There is a better way. Use thoughtful design in your compliance system to reduce errors and streamline functionality. Screenshot below is from the Kieri Compliance Documentation's Account Management Database, showing some of the magic of our full-featured 800-171 / CMMC Level 2 compliance program. I'll put the link in comments, for anyone that is interested.

54

5 Comments

With #ransomware attacks costing the average SMB over $3M, what steps has your organization taken to mitigate this insidious threat?

1

Do you have a "human firewall?" Everyone at your organization has a critical role in #cybersecurity, and proper training and staffing can help strengthen your team's defenses. Matt Durrin and I share the best practices in our on-demand webinar. https://lnkd.in/gjQ2cZwk

13

Are you headed to Black Hat? 🎩 Nucleus Security will be there, and our team is excited to connect with you! If you'd like to meet our team 1:1 to discuss unifying data across your entire vulnerability management program, book a meeting today. [Link in comments]. #BlackHat #Cybersecurity #VulnerabilityManagement #Networking

17

3 Comments

VM remains a cornerstone of preventive cybersecurity, but organizations still struggle with vulnerability overload and sophisticated threats. Tenable’s new Exposure Signals gives security teams comprehensive context, so they can shift from VM to exposure management and effectively prioritize high-risk exposures across their complex attack surface. http://ow.ly/oGFk105PbnX

3

The increasing relevance of data sanitization in classified data environments...

23

1 Comment

RSA can be hectic. If anyone is looking to for a break from Moscone, let me know. Permiso has lounge space that is walking distance away. Come meet and hang out with Permiso and Permiso's P0 Labs Team and talk/ learn about a new approach to cloud threat detection and response/ confidence in containment. We can talk about how the SIEMs, CSPMs, EDRs, and other existing security controls you'll see everywhere on the show floor consistently miss alerting on cloud threats in a timely manner or at all 🚀

20

1 Comment

As you explore Moscone, consider this: Despite their mature security setups—including CSPM, SIEM, CNAPP, EDR, and more—victims of Scattered Spider were compromised. In over 150 threat briefings and incident responses with partners like KPMG, we've consistently observed missed early detection opportunities at the IDP and SaaS layers, critical in an operational window of 3-5 days. AI integration won't shift these outcomes. The Permiso HQ is walking distance from Moscone. DM me to come by and meet the Permiso and P0 Labs team (former Mandiant), let's discuss a new purpose-built approach to cloud detection and response

1

Worried that your cloud network has security gaps that you're not seeing in real time? Book a meeting with one of our cloud security experts to demo a new solution that gives you full visibility into your cloud ops and alerts your security team of all new threats.

4