Cesar Rodriguez

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

Lots of conversations about migrating to PQC and how to approach risk assessment and planning last week during RSA Conference. I found the below summary of the latest update to NSA's guidelines very helpful. They lay out an actual timeline and give clarifications for some earlier releases. Give it a read if you can spare two minutes: https://lnkd.in/gZKmjS8P #PQC #cryptoagility #codesigning #supplychain #CBOM #RSAC

32

EC2 Compromise Leads to S3 Bucket Exfiltration

53

ICYMI: The inaugural study on EPSS performance and broader vulnerability exploitation trends published this week. If you've ever wanted data-driven answers to questions like these listed in the ToC shown here, download it today (free, no registration req'd): https://lnkd.in/gBbsgwQM #vulnerabilitymanagement #vulnerabilities #infosec

51

8 Comments

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

58

VM remains a cornerstone of preventive cybersecurity, but organizations still struggle with vulnerability overload and sophisticated threats. Tenable’s new Exposure Signals gives security teams comprehensive context, so they can shift from VM to exposure management and effectively prioritize high-risk exposures across their complex attack surface. http://ow.ly/oGFk105PbnX

3

Pretty cool to see this come to fruition, with 3 areas of focus for delivering AI capabilities for operations, enabling AI adoption, and countering AI threats

4

Small business owners, this one's for you! The NIST Cybersecurity Framework offers a proven approach to managing cybersecurity risks. This free resource provides a quick start guide to help you get started. ➡️ Learn how to identify, protect, detect, respond to, and recover from cyber threats. Download the NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide today! #cybersecurity #smallbusiness #riskmanagement #NIST https://lnkd.in/gnByJvYM

20

Critical Apache Avro SDK Flaw Allows Remote Code Execution in Java Applications: A critical security flaw has been disclosed in the Apache Avro Java Software Development Kit (SDK) that, if successfully exploited, could allow the execution of arbitrary code on susceptible instances. The flaw, tracked as CVE-2024-47561, impacts all versions of the software prior to 1.11.4. "Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute https://lnkd.in/g-eVMFCj

2

A vulnerability has been identified, CVE-2024-27322, in the R programming language that permits arbitrary code execution by deserializing untrusted data. CERT Coordination Center (CERT/CC) has issued an advisory for CVE-2024-27322, cautioning against arbitrary code execution via malicious RDS or RDX files. What should you do? ⬆️ Update R to version 4.4.0 or later promptly. ⛔Until then, avoid interaction with untrusted RDS files or packages to mitigate risks. There is currently no public proof-of-concept or exploitation evidence available. https://bit.ly/44t7vFt

10

RSA can be hectic. If anyone is looking to for a break from Moscone, let me know. Permiso has lounge space that is walking distance away. Come meet and hang out with Permiso and Permiso's P0 Labs Team and talk/ learn about a new approach to cloud threat detection and response/ confidence in containment. We can talk about how the SIEMs, CSPMs, EDRs, and other existing security controls you'll see everywhere on the show floor consistently miss alerting on cloud threats in a timely manner or at all 🚀

20

1 Comment

As you explore Moscone, consider this: Despite their mature security setups—including CSPM, SIEM, CNAPP, EDR, and more—victims of Scattered Spider were compromised. In over 150 threat briefings and incident responses with partners like KPMG, we've consistently observed missed early detection opportunities at the IDP and SaaS layers, critical in an operational window of 3-5 days. AI integration won't shift these outcomes. The Permiso HQ is walking distance from Moscone. DM me to come by and meet the Permiso and P0 Labs team (former Mandiant), let's discuss a new purpose-built approach to cloud detection and response

1

OAuth 2.0 Protected Resource Metadata draft addressing reviews since IETF Last Call Aaron Parecki and I published a new version the “OAuth 2.0 Protected Resource Metadata” specification that addresses the review comments received since the IETF Last Call. For details, see https://lnkd.in/g4huZkYg. #IETF #OAuth #metadata

31

5 Comments

Are you a contractor that uses an external cloud service provider (CSP) to store, process, or transmit sensitive defense information? DFARS clause 252.204-7012 details several requirements you must “require and ensure” meet security requirements (Are they on FedRamp.gov Marketplace?) or provide evidence that they are 100% equivalent to the FedRAMP moderate baseline. They must comply with all DFARS 252.204-7012 requirements for: Cyber incident reporting Malicious software Media preservation and protection Access to additional information and equipment necessary for forensic analysis Cyber incident damage assessment You can read the requirements yourself here: https://lnkd.in/gb7qEeaq. Or give us a call at MNS Group. We’re an Authorized C3PAO that can help provide guidance. #DoD #compliance #contractors #cybersecurity #assessment

43

1 Comment

Hey everyone, here is where we will begin really digging into the details of #CMMC levels. My full post is here: https://lnkd.in/gZKXAY3C I tried to not be too wordy and dry, but there's only so much you can do with government regulations (even with 10+ years of experience with them, I can only do so much). For a quick summary, level 1 focuses on mostly basic hygiene requirements. It does bring in physical security as part of cyber, which I was happy to see. The most technical requirements are probably the segmentation and malicious code monitoring/scanning parts. Even for companies without DoD contracts, I would probably recommend that level 1 be followed just as a general minimum level of protection. All of these requirements will be a part of levels 2 and 3 as well, and we'll see a big jump in complexity for level 2 next week.

8

1 Comment