Michael Scheidell

GSA announced last week that, "Starting June 8, 2024, GSA will begin collecting Common [#SSDF Attestation] Forms for new contracts (including micro-purchases) and the exercise of contract options, that include the use of software, regardless of whether or not the software is considered critical." This is a major update because it means all vendors dealing with GSA or a GSA contracts must comply in June and NOT in September, like originally thought. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT 

16

2 Comments

ICYMI: Office of Inspector General Report in Brief from the Alabama Medicaid Management Information Systems (MMISs) and Eligibility and Enrollment (E&E) systems security audit. The scope of the audit was limited to external facing systems and a phishing exercise (GoPhish). https://lnkd.in/emGaGWQa The OIG audit reports are always good to get a glimpse of the focus of these security audits. The response to recommendations can also be helpful for orgs struggling with some of the same issues (Starting on page 14). Key Takeaways 1) Vulnerability Management: Existing tools were not effective in detecting system flaws. 2) Software Development: Issues were not remediated prior to deploying on production systems. 3) Phishing was not successful (0 opened emails......) #healthcare #hipaa #cybersecurity #hhs #riskmanagement #risktolerance #riskassessment #criticalinfrastructure #hitrust #criticalcontrols #penetrationtesting #vulnerabilityassessment #vulnerabilitymanagement

2

#SEC finalized amendments for S-P, designed to protect PII. RIAs, BDs and more must, (1) have a written incident response plan (IRP) and (2) develop procedures to notify people whose PII was improperly accessed. To quote the SEC, "The basic idea for covered firms is if you’ve got a breach, then you’ve got to notify. That’s good for investors.”" 18-24 months to implement. #ria #rias #cybersecurity

4

Earlier this year, Cyentia Institute published a meta-study analyzing the top ATT&CK techniques reported across 20+ industry sources. NOT ONE OF THEM reported observing T1195.003 - Compromise Hardware Supply Chain. Hold on - my aid has an urgent message for me...oh my...they what?!...pagers exploding - really?...I see...got it...will do... Sorry for the interruption. As I was saying, T1195.003 was THE MOST REPORTED sub-technique in the entire study! Download it today from the compromised device of your choice: https://lnkd.in/eafNi5u3 #supplychain #cybersecurity #fud

91

6 Comments

NIST Releases the C-SCRM Due Diligence Assessment Quick-Start Guide for Public Comment https://lnkd.in/dYxE3Uu6

12

The Environmental Protection Agency lacks a documented plan to coordinate incident reporting with CISA, the agency’s Office of Inspector General found. Environmental Protection Agency officials found critical or high-risk vulnerabilities in 97 drinking water systems that serve more than 26 million people across the U.S., according to a report released last week by the agency’s Office of Inspector General. Another 211 water systems, servicing almost 83 million people, had medium-to low-risk vulnerabilities, including open portals that were visible from the outside. These water systems could face major disruptions or physical damage if a malicious hacker tried to exploit those vulnerable systems. The OIG report noted the EPA does not have an incident reporting system and relies on the Cybersecurity and Infrastructure Security Agency’s system. The OIG also could not find documented policies and procedures for how the EPA coordinates with CISA and other federal agencies to address these issues. #criticalinfrastructurecyberrisk #cyberriskmanagement #confidentialcomputing #thirdpartyriskmanagement #threatinformeddefense #GRC #cyberinsurance

2

The latest from OODA Loop Contributor Emilio Iasiello: In June 2024, the Office of the National Cyber Director (ONCD) released its report Summary of the 2023 Cybersecurity Regulatory Harmonization Request for Information, a government effort whose purpose is to find a path forward to creating a comprehensive framework to strengthen cybersecurity resilience across all sectors; simplify oversight and responsibilities of cyber regulators; and reduce administrative burden and cost on those organizations regulated.  The RFI adhered to Strategic Objective 1.1 of the 2023 National Cybersecurity Strategy, “Establish Cybersecurity Requirements to Support National Security and Public Safety.”  Eighty-six organizations responded to the RFI, representing the critical infrastructure sectors, as well as state and local government associations, academia, and non-profit and professional organizations.  The report found three major outcomes from those that responded to the survey:  1) lack of harmonization and reciprocity impacted cybersecurity outcomes while inflicting high compliance costs; 2) regulatory harmonization had challenges that extended to all sectors and organizations of all sizes and crossed jurisdictions; and 3) it was well within the U.S. government’s ability to address these existing challenges.   https://lnkd.in/eqU486u9

4

1 Comment

National Institute of Standards and Technology (NIST)  has released the RMF Small Enterprise Quick Start Guide. For organizations of all sizes, managing risk (including information security and privacy risk), is critical for organizational resilience. This guide is designed to help small, under-resourced entities understand the value and core components of the NIST Risk Management Framework (RMF) and provide a starting point for designing and implementing an information security and privacy risk management program. This document is not intended to replace the RMF; it is intended to be an introductory guide to help organizations get started. Link: https://lnkd.in/deZ9csya PDF Source: https://lnkd.in/dJaetyYx #NIST #dataprivacy #RMF #cybsersecurity #risk

1

This Kiteworks article provides a comprehensive guide to navigating the complex landscape of sensitive content communication risk within the context of NIST CSF 2.0. It's crucial for organizations to understand and mitigate these risks effectively, especially considering the ever-evolving cybersecurity threats. Well worth a read for any organization serious about safeguarding sensitive information in today's digital age. NIST CSF 2.0: The Ultimate Guide to Managing Sensitive Content Communications Risk 👉 Learn more: https://gag.gl/BSKceP #cybersecurity #compliance #NIST #NISTCSF #CybersecurityFramework

11

1 Comment

⚡️Some domains likely used by #transparentTribe #APT36 counciling[.]com nbssedelhi[.]org ashifdigitalseva[.]xyz birthdeath[.]in gov-certificate[.]com viewss[.]click admin-mcas-df[.]ms admin-mcas[.]ms mcas-df[.]ms mcas[.]ms verifycertificate[.]info nimsme[.]org

1

1 Comment

🚨 CISA Weekly Vulnerability Summary: SB24-225 The Cybersecurity and Infrastructure Security Agency (CISA) has released its Vulnerability Summary for the week of August 12, 2024. This bulletin, SB24-225, sheds light on the latest vulnerabilities listed by the National Vulnerability Database (NVD). 🔍 Key Highlights: High-Severity Vulnerabilities: Cisco IOS XR: CVE-2024-3422: A flaw that could enable unauthorized access to sensitive system functions. Google Android: CVE-2024-2356: Critical vulnerability allowing remote code execution. VMware vSphere: CVE-2024-1457: Issues that could lead to compromised virtual environments. Notable Affected Products: QNAP NAS Devices: Multiple vulnerabilities impacting data integrity. OpenSSH: CVE-2024-4523: Potential exposure to unauthorized access. Emerging Threats and Advisories: Microsoft Exchange Server: Ongoing threats and advisories emphasizing the need for timely patching. 🌟 Mitigation Strategies: Deploy Patches Immediately: Ensure your systems are up-to-date with the latest patches from vendors to mitigate risks. Strengthen Monitoring: Implement enhanced security monitoring to detect and respond to potential exploitation attempts. 🚀 Engage and Share: How is your organization addressing these vulnerabilities? Share your strategies and insights to foster a secure and informed community. For more details, read https://lnkd.in/dmqCxvAN. 🚀 #CISA #Cybersecurity #InfoSec #VulnerabilityManagement #PatchNow

13

1 Comment

Public Safety Software News: Mark43 announces BriefAI and ReportAI Mark43 BriefAI, an AI-powered case summarization tool, rapidly distills the key facts of a case to accelerate investigations Mark43, the leading cloud-native public safety software provider, today announced Mark43 ReportAI and Mark43 BriefAI, two AI-powered tools to transform the efficiency, productivity, and accuracy of public safety operations. Public safety agencies nationwide face increasing staffing challenges and are being tasked with doing more with fewer resources. Report writing, while essential to public safety work, often pulls officers away from their focus on community safety. Investigations are often slowed by fragmented information sharing and the time-consuming task of reviewing lengthy case files to identify key facts and leads. With BriefAI and ReportAI, these challenges are transformed into opportunities for efficiency. By automating case summarization, investigators can quickly distill critical information, accelerating decision-making, assignment and improving case outcomes. ReportAI enhances the accuracy and quality of reports, freeing up valuable time for officers, and ultimately empowering first responders to focus on solving crimes and public safety. “Our vision is to completely transform public safety by delivering the most advanced, cloud-native platform that serves as the real-time operating system for every agency,” said Robert Hughes, CEO of Mark43. “Only Mark43 offers a cloud-native, modern integrated CAD and RMS, enabling first responders to operate with peak efficiency and effectiveness. With solutions like BriefAI and ReportAI, we are revolutionizing how agencies manage information, empowering officers to focus on what truly matters—protecting and building safer communities. This is a new era for public safety, and Mark43 is leading the way.” #publicsafety #publicsafetysoftware #publicsafetytechnology #technology #AI #AITechnology #reporting #lawenforcement #cloudnative #investigations #Mark43 #Computeraideddispatch #CAD #RMS #Recordsmanagementsystem #information #police1 #police1magazine Robert Hughes, Wendy Gilbert, Matthew Polega Read the full article here--> https://hubs.li/Q02T66JP0

26

Last year, our p0 Labs Team at Permiso Security published groundbreaking research on Scattered Spider (aka LUCR-3), exposing their sophisticated cloud attack methods. Their weapon of choice? Stolen credentials to move invisibly through cloud environments, making traditional security tools nearly blind. Through the Permiso platform, we've been helping organizations detect compromised credentials across IDaaS, SaaS, and cloud environments in minutes. And because we know these attacks challenge even the most security mature enterprises, we've released numerous open-source tools to help the broader community detect LUCR-3 and similar credential-based cloud attacks. Check out our report here: https://lnkd.in/gSkwCmqg

11

The posters may change over time, but the fundamentals of OPSEC do not: 1) Identify your critical information 2) Evaluate threats 3) Analyze vulnerabilities 4) Assess risks 5) Apply countermeasures 6) Periodically reassess. https://lnkd.in/eQ6qKxs4

135

10 Comments

Follow the DVMS Institute for exciting announcements on "HOW" organizations of any Size, Scale, or Complexity can Operationalize a NIST Cybersecurity Framework Digital Value Management System™ capable of delivering the Trusted, Resilient, and Auditable digital outcomes government auditors expect

16

This is very interesting... seems to be a riff on an analysis technique that we described in an article titled "Beyond Timelines - Anchors in Relative Time" ten years ago in Digital Forensics Magazine. The technique has been applied to extremely high-profile and high-stakes cases since then.

11

2 Comments

Despite the rapid strides and dramatic advancements, not everything is hunky-dory in the world of #Artificiallntelligence. These pitfalls automatically become far more relevant to the #security sector, considering their implications for the overall apparatus. An insight for Rabdan Academy:

16

Are videos critical to your #OSINT investigations, but you don’t have a reliable tool to download them? 🤔 The Video Download extension of Silo for Research gives you quick access to a reliable downloader to capture videos in an instant. 📸

10