Vinson Protect adds NIST Cybersecurity Framework v2.0! You all asked for it - now it's live! You can now add the National Institute of Standards and Technology (NIST) Cybersecurity Framework v2.0 to your Vinson Protect organization! Building upon the K12 SIX Essential Cybersecurity Protections, Center for Internet Security Critical Security Controls, and ClassLink's Cybersecurity Rubric, the CSF adds another lens through which to evaluate your schools' cybersecurity preparations. https://lnkd.in/gJryspY6 Are you curious about Vinson Protect? Why not join the 100+ schools that are using the application? The application allows schools to create audits, security reports, and security plans, track incidents, and manage/delegate tasks to team members. And it's completely free for schools to use! Check it out and sign up for your account --> https://vinsonprotect.com #vinsonprotect #nistcsfv2 #edtech #cybersecurity

7

The unusual and persistent probing activity over the span of multiple years should be a reminder to organizations to identify and remove all open DNS resolvers from their networks. https://lnkd.in/ghdP4QDe

2

In May, ransomware threat actors struck national hospital operator Ascension, causing system downtime, delayed lab results, and handwritten medication orders, as NPR reported. Sophos's study found that 34% of cyberattacks originate from email, while 32% come from device vulnerabilities, underscoring the significant risk ransomware poses to healthcare organizations. An accidental malicious download can lead to attackers gaining admin-level access, allowing them to access confidential data, modify system configurations, or delete security logs. Education and preparedness are so important for healthcare staff to help avoid these cyberattacks. #Cyberattacks #HealthcareCybersecurity #Ransomware #Healthcare

4

🔒 **FIPS 140 vs. CMMC: What You Need to Know** 🔒 Understanding the nuances between standards can make or break your organization's compliance strategy. Let’s dive into two critical frameworks: **FIPS 140** and **CMMC**. 🤔 **What’s the difference?** FIPS 140 is a general-purpose standard aimed at validating cryptographic modules used across government and industry. It features a four-tiered validation process based on security capabilities, ensuring that all cryptographic modules meet stringent requirements. Conversely, the **Cybersecurity Maturity Model Certification (CMMC)**, developed by the U.S. Department of Defense, focuses specifically on defense contractors. It incorporates three levels of maturity to safeguard Controlled Unclassified Information (CUI), demanding the use of FIPS-validated cryptography for robust data protection. 🛡️ **How do they work?** - **FIPS 140**: Requires validation of cryptographic modules, public reviews, and rigorously tested algorithms, making it comprehensive but complex. - **CMMC**: Targets contractors' use of validated cryptography specifically for CUI, emphasizing practical implementation within specific environments. 💡 **Practical Implications**: 1. **Compliance**: For CMMC compliance, contractors must use FIPS-validated cryptographic solutions to protect CUI. This means selecting and implementing encryption tools and technologies that have been validated under the FIPS 140 standard. 1. **Implementation**: SMEs do not need to validate their own cryptographic modules. Instead, they should focus on ensuring that their encryption solutions are FIPS-validated, which is a key requirement for protecting CUI under CMMC. 1. **Cost & Complexity**: The process of validating cryptographic modules under FIPS 140 can be complex and costly. However, SMEs can simplify their compliance efforts by utilizing FIPS-validated encryption solutions, thus meeting CMMC requirements without the burden of direct validation. Understanding and implementing these frameworks is crucial for maintaining the integrity and confidentiality of sensitive information. How is your organization preparing to meet these evolving standards? Let’s connect and explore strategies to strengthen our cybersecurity posture! #Cybersecurity #Compliance #FIPS140 #CMMC #InformationSecurity

2

There's a punchy saying in business you've probably heard before, just not in the context of cybersecurity. It's from Jim Barksdale, the CEO of Netscape at the time it was coined: "There’s only two ways I know of to make money: bundling and unbundling." ...except people never call it that. Barksdale made this observation himself years later. We've seen "bundling" or "unbundling" called a few things in cybersecurity: – Platformization – Consolidation – Modularization – Best-of-breed – Decoupling I'm sure you can think of a few more terms and examples. Basically every company is either bundling or unbundling — intentionally or unintentionally, and whether they call it by name or not. Once you recognize this, understanding a company's strategy gets a lot easier.

42

9 Comments

Okta admins, take note. There are mitigation steps to limit the damage that these credential stuffing attacks can do. MFA is your friend. Different passwords for different things! #Okta #cybersecurity #cyberaware #cybersecuritynews #cyberattack

5

Like A Good Neighbor, Huntress Is There Huntress has recently been authorized by the Common Vulnerabilities and Exposures (CVE) Program as a CVE Numbering Authority (CNA). The Program is an international and community driven-effort with a mission to "identify, define, and catalog publicly disclosed cybersecurity vulnerabilities". The essentially all knowing directory relies on established cybersecurity experts to spot and name security threats in order to centralize the knowledge and establish a single source of truth for vulnerabilities. Huntress's participation means they are contributing to a global database helping everyone, not just clients, to build better protection for systems worldwide against attacks. #cyberresiliency #huntress #cna #stayvigliant #msp

7

School Leaders - 2 *NO COST* Ways to Increase your Cybersecurity Preparation ... and one that does cost but is **TOTALLY** worth it. Friday’s report, released by the Office of the Inspector General of the Intelligence Community, concludes that while federal agencies have broadly improved their ability to share threat information and defensive mitigations, long-standing policy and technical concerns hinder rapid information sharing. This is also very true of schools and school districts. Below are some ways to increase the amount of threat information your school receives. 1. *FREE* Join the Center for Internet Security's MS-ISAC. The mission of the MS-ISAC® is to improve the overall cybersecurity posture of U.S. State, Local, Tribal, and Territorial (SLTT) government organizations through coordination, collaboration, cooperation, and increased communication. (https://lnkd.in/giiZbxAb) 2. *FREE* Sign up for a free Vinson Protect account and choose the K12 SIX "Essential Cybersecurity Protections" initial audit framework. Perform an audit of your school, assign tasks to your staff, and print a 1-page security status report and a multi-page security plan for the school year. You can also create your incident response team and create, track, and print reports for designated security incidents. (https://vinsonprotect.com/) 3. *NOT FREE BUT WORTH IT** JOIN K12 SIX (https://www.k12six.org/). The K12 Security Information eXchange (K12 SIX) is the only national non-profit organization dedicated to protecting the U.S. K-12 community—including school districts, charter schools, private schools, and regional and state education agencies—from emerging cybersecurity threats. K12 SIX operates as an enhanced information sharing and analysis center (ISAC) for the K-12 education sector, facilitating the sharing of actionable threat intelligence with its membership. In addition, K12 SIX offers its members security training, access to virtual CISO services, leadership opportunities, and much more. A member of the Global Resilience Federation, K12 SIX leverages decades of cross-sector information-sharing experience and expertise from the financial services, legal, health, and energy sectors. https://lnkd.in/gfBWNuqp

9

CMMC Level 2 Assessment Objective: Role Separation PRACTICE: Organizations must separate user functionality from system management functionality. ASSESSMENT: System management functionality includes functions necessary to administer databases, network components, workstations, or servers, and it typically requires privileged user access. The separation of user functionality from system management functionality is physical or logical. Organizations need to prevent users and user services from accessing system management functionality on IT components. Be prepared! Your assessor could ask to 🔍 EXAMINE system and communications protection policy. 🗣 INTERVIEW system or network administrators. 📝 TEST separation of user functionality from system management functionality. (CMMC Assessment Guide: Level 2 Version 2.11, page 212) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

46

New blog on CMMCAudit. This one is real basic, but has a few tidbits that might be interesting for you experienced cybersecurity folks. Some excerpts from the article... Assessments are priced by the complexity of your environment: having physical facilities, lots of users, or development labs can increase the price significantly. The sales team will normally offer a fixed-price quote and should be able to explain timing as well as what to expect. What is a red flag that you aren't ready? No one on the team has done it before. Book learning is way different than real life. Passing a certification test is nice, but it doesn’t compare to the experience of building and maintaining an information system that meets all 320 objectives (110 requirements). Having someone on your team who has experienced a formal assessment on either side (assessor or assess-e) is the best indication you will pass. #CMMC

45

10 Comments

MediExcel data breach exposes over 555,000 patient documents • MediExcel, a US healthcare provider, left an open Amazon S3 bucket exposing over 555,000 patient documents, including diagnoses and claim forms. • The exposed data could be exploited for identity theft, insurance fraud, or extortion. • The dataset was accessible from May 2023 to April 2024 due to an AWS S3 access control list misconfiguration. Revalidate the security posture from all aspects. Get it peer reviewed. Remember that perimeter is one of the ultimate line of defence for your infrastructure. #cybersecurity #perimetersecurity #aws #cyberawareness

4

CMMC Level 2 Assessment Objective: Split Tunneling PRACTICE: Organizations must prevent remote devices from simultaneously establishing nonremote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). ASSESSMENT: This requirement is implemented in remote devices—such as smartphones—through configuration settings to disable split tunneling in those devices and by preventing configuration settings from being readily configurable by users. Split tunneling for a remote user uses 2 connections: accessing resources on the internal network via a VPN and simultaneously accessing an external network such as a public network or the internet. Split tunneling presents a potential opportunity where an open, unencrypted connection from a public network could allow an adversary to access resources on the internal network. Be prepared! Your assessor could ask to 🔍 EXAMINE procedures addressing boundary protection. 🗣 INTERVIEW system or network administrators. 📝 TEST mechanisms implementing boundary protection capability. (CMMC Assessment Guide: Level 2 Version 2.11, page 220) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

45

Thwarting Cyberattacks in Healthcare In healthcare, cyberattacks are a constant threat. Here's how a med-tech firm successfully thwarted one: 1. Detection: Advanced AI flagged a suspicious login attempt. 2. Action: The cybersecurity team isolated the network segment. 3. Analysis: Investigation revealed an attempted ransomware attack. 4. Resolution: Swift action prevented data loss and secured patient info. This highlights the need for strong cybersecurity to protect health data.  How do you protect your company from cyber threats? #Cybersecurity #Healthcare #MedTech #Leadership #PatientSafety

3

That was fast! Especially for government timelines. After announcing 48 CFR would be available for public comments just last week, it is out for public comments. This is the rule that will require the government to put a #CMMC in contracts if the contractor will process, store, or transmit CUI. Comments are due before October 15, 2024. On first read, it is what has been expected with no surprises. Some of the highlights: - Requires CMMC Level to be identified in all solicitations (with a few exceptions) where FCI and/or CUI will be handled by the contractor - Confirmed the phased rollout previously defined in the 32 CFR proposed rule - Requires primes to confirm subcontractors, at all tiers, meet CMMC requirements - Requires contractor to meet CMMC requirements prior to contract award - Includes foreign suppliers - Defines a minimal burden, approx. 15 minutes per system, to comply with the proposed rule as the technical requirements have already been addressed by the 32 CFR proposed rule Time to dig deeper to see how it will affect DoD contracts. Did you see anything interesting in the proposed rule? https://lnkd.in/gq2TZVB9

8

1 Comment

If your Cyber Supply Chain Risk program is not supported by technical risk teams, your program is probably a useless checkbox. The reality is supply chain risk management, and yes, cyber SCRM, touches every aspect of the business. Not just cyber. Because it requires an all-of-business change in how we procure, implement and operate technology. But I see a lot of programs spun up out of the procurement group or a compliance function without truly understanding the risks they are tasked with managing. Will your SCRM team know how to read and validate a network security architecture diagram? Will they understand what a good disaster recovery plan looks like? What about that critical API your business depends on and how they provision high availability for that? What about the actions YOU need to take? For instance, testing software updates before deploying into production. Or do you trust them because you did a vendor assessment 8 months ago? C-SCRM might have more wasted investment than any other area in modern cybersecurity programs. There's a reason many CISO's struggle to derive value from the spend. But it's not because it's not useful. You are just doing it wrong. Rethink your approach, stop doing what everyone else is doing and use some common sense. The scale of the problem is massive and you probably have the wrong people doing the work in the wrong areas. Start with a solid Business Continuity Plan (BCP), understand the business risks and identify your most critical dependencies. Who in your organization understands how these work? These are the folks that need to be part of the conversation, not only non technical people executing a toothless assessment program. Do some threat modeling and do not forget to model the accidental vectors (like broken software updates and human error). What are your opportunities to reduce the risk? You won't be able to fix everything, but maybe there are places you need to plan for and train on manual process or implement additional mitigating controls. Some may be vendor-supplied controls, some are things you will need to handle yourself. It is quite likely that exercising your BCP/DR/IR plans is the most reasonable approach to deal with these concerns. Questionnaires and assessments might be part of the solution, but ask yourself if your process is actually helping reduce risk in your program. Or is it just noise? #cybersecurity #scrm #supplychainrisk #businesscontinuity #bcp #criticalfunctions

21

8 Comments