Patrick Beggs

CMMC Level 2 Assessment Objective: Alternative Work Sites PRACTICE: Organizations must enforce safeguarding measures for containing controlled unclassified information (CUI) at alternative work sites. ASSESSMENT: Alternative work sites may include government facilities or the private residences of employees. Organizations must define and implement safeguards to account for protection of CUI beyond the enterprise perimeter. Safeguards may include physical protections, such as locked file drawers, as well as electronic protections such as encryption, audit logging, and proper access controls. Be prepared! Your assessor could ask to: 🔍 EXAMINE a list of safeguards required for alternative work sites 🗣 INTERVIEW personnel approving use of alternative work sites 📝 TEST organizational processes for security at alternative work sites (CMMC Assessment Guide: Level 2 Version 2.11, page 186) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

47

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

🚨 You've Been Breached...Now What? 🚨 In our latest IJIS Institute Podcast, we dive deep into how to effectively respond to a cyber incident. Using the NIST Cybersecurity Framework (CSF), we cover essential controls to have in place for taking action during a cyber event. Stay tuned until the end, where Jeramy Cooper-Leavitt and I share practical tips you can implement today! Don't miss out on this crucial episode! #CyberSecurity #NISTCSF #CyberIncidentResponse #IJISPodcast #PracticalTips

7

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

EPSS support is now available in Tenable #Nessus, along with CVSS v4. These scoring systems complement Tenable Vulnerability Priority Rating (VPR) to help you identify and take action on the vulnerabilities that pose the greatest risk specific to your environment. 🔗 Learn more: https://lnkd.in/g2kgY9Tx

7

EPSS support is now available in Tenable #Nessus, along with CVSS v4. These scoring systems complement Tenable Vulnerability Priority Rating (VPR) to help you identify and take action on the vulnerabilities that pose the greatest risk specific to your environment. 🔗 Learn more: https://lnkd.in/g2kgY9Tx

6

Grateful to VMblog for the chance to share my insights on public safety cybersecurity predictions. Key topics include: - Emerging Threats - Cloud Adoption Trends - Funding Challenges - Framework Adoption Dive into the article for an in-depth look at these critical themes. Your thoughts and feedback are always welcome! #CyberSecurity #PublicSafety #CloudAdoption #Funding #FrameworkAdoption #CyberThreats

8

Occasionally someone in security ops will question why https --> http redirects are a poor practice so I wrote this blog post a while back to try and crystalize the risks. https://lnkd.in/ecGkHh2U #Bitsight #cybersecurity

32

1 Comment

It's here - CRQ Training! If you're a CISO, risk analyst or assessor interested in quantifying cyber risk don't miss this CRQ Mastery Workshop. Learn basic and advanced method. Hands-on exercises. Full toolkit and risk models. ISC2 and ISACA Chapters save and additional 20% for their members. 20 CPEs. More info and registration https://lnkd.in/ecVj8V5N #ISC2, #ISACA, #Training, CyberRiskQuantification, #CISO, #Cybersecurity

5

This week we are going to look at multi-factor authentication, also known as two-factor authentication. This type of authentication has often been referred to as a "best practice" for securing your accounts. I would suggest that today, multi-factor authentication is really a "required practice" both at home, and at work. https://conta.cc/4b9Kg5m

3

Evolving threats, new risks — 2025 is unpredictable. Learn how to protect your organization in The SIG Download. Register now. #AkamaiSecurity https://bit.ly/3VUoUDX

1

✅ The forensic investigator (no all cyber) must understand IP networking and communication protocols... to determine if they are being exploited.

5

1 Comment

🛑 Fraudsters will always capitalize on current events and the upcoming Olympic Games is no exception. Unsuspecting users likely clicked on the website because it appeared to be a legitimate entity that specialized in the sale of Olympic tickets. The website’s placement on the search engine under the official Paris Olympics ticket site could have further added to its legitimacy, convincing users that they were an authorized and safe source. While this specific domain should no longer be active, we expect other bad actors to take advantage of the event and create new fraudulent Olympics-related websites. 👉🏽 The only way to get tickets for the Paris 2024 Olympic and Paralympic Games is through the organization’s official ticketing website.  Proofpoint recently identified a fraudulent website purporting to sell tickets to the Paris 2024 Summer Olympic Games. The website “paris24tickets[.]com” claimed to be a “secondary marketplace for sports and live events tickets.” It was notably listed as the second sponsored search result on Google, after the official website, when searching for “Paris 2024 tickets,” and related searches. Proofpoint confirmed with official sources in France that the site was fraudulent. Proofpoint’s Takedown Team worked with the registrar to suspend the domain quickly after its initial discovery. The site was just one of many. According to the French Gendarmerie Nationale, their efforts in collaboration with Olympics partners have identified 338 fraudulent Olympics ticketing websites. Of these, 51 have been shut down, with 140 receiving formal notices from law enforcement. On the website identified by Proofpoint researchers, the homepage listed many Olympic events, and if the user clicked on one of the sport icons, they were taken to a ticketing page that allowed the user to select tickets and provide payment data. The site also appeared to allow the user to establish accounts to buy and sell tickets.  The website design appeared similar to other well-known ticketing sites visitors would be familiar with, increasing the perceived legitimacy of the site.   #olympics #tickets #fraud #websites #paris #proofpoint‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

1

Imagine diving deep into threat intelligence to uncover insights on potential threats targeting your industry, company, or even your colleagues. With Investigations Management, you can seamlessly manage and share these findings without leaving Ignite! 🕵️‍♂️💼 Investigations Management serves as your personal case management system for Flashpoint intelligence. It allows you to assign tasks, control access to sensitive information, and keep a close watch on threat actors or groups—all within the Ignite platform. 📊🔒 - Keep all your investigations organized in one place, ensuring no detail gets overlooked. - Assign tasks related to threat analysis or response directly within Investigations Management, keeping your team aligned and productive. - Safeguard sensitive data with controlled access settings, ensuring confidentiality at all times. - Stay updated on ongoing investigations and monitor threat actors or groups proactively. - Seamlessly integrate Flashpoint intelligence updates into your workflow, leveraging the latest insights effortlessly. - Collaborate effectively with your team, sharing insights and recommendations to strengthen your security posture. Empower your team to stay ahead of potential threats while optimizing your workflow within Ignite. It's your ultimate tool for proactive threat management and intelligence sharing. 🔍🛡️ #threatintelligence #investigations #Flashpoint #intelligence #risks #security

6

AC-02 is in the top 5 most important controls I'd recommend developing familiarity with 🚨 Let's continue our Neverending Story through NIST 800-53 with: AC-02 Access Control Account Management Simply stated: AC-02 governs: - Accounts and people (users, managers, roles, groups, etc.) - Access authorizations and privileges - Account management processes - Account monitoring and review - Account PII privacy ➡️ There are 12 control elements (A-L) within AC-02 🙂‍↕️ which each need to be fulfilled or inherited for overall AC-02 compliance How to simplify control implementation: - Consider how account management is conducted throughout the enterprise, application team, cloud service provider, data center, etc. - Map to Identity and Access Management tools and services - Leverage inheritance for external team services - Revisit onboarding and off-boarding processes How to automate control implementation & assessment: - Integrate configuration checks for access control mechanisms - Leverage Identity and Access Management capabilities - Configure logging and alerts for audits and monitoring - Automate account review checks ⬇️ Let me know what I missed ⬇️ #GRCEngineering #NIST #NIST80053 #Cybersecurity #ZeroTrust #GRC #AccessControl #PoliciesandProcedures #AI #AccountManagement

19

5 Comments

A recent report from the Environmental Protection Agency (EPA)’s Office of Inspector General (OIG) has revealed significant cybersecurity vulnerabilities in over 300 U.S. drinking water systems. These weaknesses threaten service disruptions, data breaches, and potential damage to critical infrastructure, affecting the safety and accessibility of water for millions of Americans. #DataBreaches #CyberAttacks #WeProtect cybersecurity.art - Art of Cyber Security https://lnkd.in/gXWedhpV

2