Carl Froggett

🚨 Big News from the Australian Cyber Security Centre (ACSC): 🚨 The ACSC has issued recommendations regarding cryptographic standards that will no longer be approved for use beyond 2030: ❌ AES-128 and AES-192 ❌ RSA ❌ SHA-224 and SHA-256 ❌ HMAC-SHA256 ❌ DH and ECDH ❌ ECDSA This is significant as NIST has slated the removal of many of these methods by 2035—indicating Australia is taking a more aggressive stance, pushing for their removal 5 years earlier. What does this mean for organizations? It’s time to start preparing for a post-quantum cryptography future by exploring quantum-resistant algorithms and adapting security strategies to stay ahead. #CyberSecurity #Cryptography #QuantumComputing #PostQuantum #CyberResilience #DataProtection #ASD #ACSC #InfoSec #Encryption

12

1 Comment

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

ECS selected #Axonius to support DHS's CDM program. Axonius will provide comprehensive #Cybersecurity asset visibility and vulnerability management, enabling efficient risk management: https://dy.si/m5nFJ

2

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

55

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

New Cyentia research, continuing our movie title/cover theme with SecurityScorecard. This one plays off Godzilla 2000 and focuses on digital supply chain risk among the world's largest organizations listed on the Global 2000. It joins "Close Encounters of the Third Party Kind" and "The Fast and the Frivolous," which you can find on our site at www.cyentia.com/research #cybersecurity #supplychainsecurity #thirdpartyrisk #supplychainrisk #cyberrisk

12

An interesting case of ICS (Industrial control system hacking) this would likely not have happened if the routers/gateways had used strong certificat based authentication. Now is the time to secure your ICS networks. #iec62443

4

Hey everyone, here is where we will begin really digging into the details of #CMMC levels. My full post is here: https://lnkd.in/gZKXAY3C I tried to not be too wordy and dry, but there's only so much you can do with government regulations (even with 10+ years of experience with them, I can only do so much). For a quick summary, level 1 focuses on mostly basic hygiene requirements. It does bring in physical security as part of cyber, which I was happy to see. The most technical requirements are probably the segmentation and malicious code monitoring/scanning parts. Even for companies without DoD contracts, I would probably recommend that level 1 be followed just as a general minimum level of protection. All of these requirements will be a part of levels 2 and 3 as well, and we'll see a big jump in complexity for level 2 next week.

8

1 Comment

One of the most common APTs we see in Australia as reported by OAIC NDB report is compromised credentials. Since reporting began in 2018, its accounted for ~60% of cyber incidents. In this blog we talk about what APTs are and how to mitigate against them. Well worth the read, some great practical advice. https://lnkd.in/gWtzGwu6

7

🔐 CMMC Needs Clear SSO Rules: Here’s Why- Current CMMC, NIST 800-171/172, and FedRAMP lack explicit controls for Single Sign-On (SSO), creating critical security risks. The Problem ⚠️ No defined SSO boundaries ⚠️ Unrestricted third-party SSO poses risks ⚠️ Breach amplification and reduced visibility The Solution * Define SSO boundaries * Restrict SSO to vendor ecosystems * Align with Zero Trust principles The financial sector enforces strict SSO controls—shouldn’t defense systems do the same? 💬 What’s your take? Should SSO boundaries be mandatory in cybersecurity frameworks? #Cybersecurity #CMMC #NIST #DefenseIndustry #ZeroTrust #SSO #DoD #CISA #NSA

4

💡 Do I need to report PKI maturity level? Reporting your PKI maturity level isn’t just a checkbox! 🛠️ While not mandated by the PKI Consortium, documenting your PKI maturity level can: 📈 Highlight your current PKI status to stakeholders 🚀 Pinpoint key areas for improvement 📊 Track progress over time effectively Depending on your organization's needs, regulatory requirements, or improvement goals, reporting might be essential. Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium Paul van Brouwershaven Leigh Bailey

9

1 Comment

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

EPSS support is now available in Tenable #Nessus, along with CVSS v4. These scoring systems complement Tenable Vulnerability Priority Rating (VPR) to help you identify and take action on the vulnerabilities that pose the greatest risk specific to your environment. 🔗 Learn more: https://lnkd.in/g2kgY9Tx

7

EPSS support is now available in Tenable #Nessus, along with CVSS v4. These scoring systems complement Tenable Vulnerability Priority Rating (VPR) to help you identify and take action on the vulnerabilities that pose the greatest risk specific to your environment. 🔗 Learn more: https://lnkd.in/g2kgY9Tx

6

FBI and CISA: Chinese hackers breached multiple US telecom companies, compromising the “private communications” of US officials and stealing customer call data https://bit.ly/4fEvh6q

1

Supply chain attacks are no joke, and the new OMB M-24-04 FISMA guidance is right on target. This fresh approach is all about reducing risk by focusing on zero-trust principles and a unified attack surface management strategy. With cyber threats coming from every angle, especially through complex supply chains, it's time we step up our game. If you work with federal systems, this is the blueprint for staying ahead of the curve and safeguarding our critical infrastructure. #SuuplyChain #CyberAttacks #Risk

17

Thrilled to have the opportunity to analyze #vulnerability remediation timelines again, this time using data from NopSec. The chart below is based on a survival analysis of vulnerabilities across an environment. Essentially - the time it takes to remediate all affected assets after a vuln is discovered. Everytime I see analysis like this, I'm reminded of how different the real world of #vulnerabilitymanagement is from the "just patch it all yesterday" shallow advice that's so often bandied about. If it were that easy, vuln survival curves wouldn't look like this time after time. How does this square with your experience? I'll be discussing this chart and several others in a webinar next week. Register here and bring your questions, comments, and rants! https://lnkd.in/eHWDrEYN

92

26 Comments