Itzik Kotler

For those waiting for the FAR update regarding #ssdf attestations... The latest Open FAR Cases report shows on May 30th Case Number 2023-002, Supply Chain Software Security, that OMB identified draft proposed FAR rule issues. OFPP, FAR and DAR staff are now working to resolve those issues. It is my understanding that this work remains opaque, and that there was no public disclosure of precisely what issues OMB identified with the proposed FAR rules relating to supply chain software security. Regardless of the status of Case 2023-002, the GSA is now requiring #ssdf attestations for anything it buys that contains software as of this past Monday morning when the government opened for business. GSA quietly updated GSA Form 7700 last month to take advantage of the CISA standard form's disclosure that "Agency-specific instructions may be provided to the software producer outside of this common form." GSA Form 7700 form has two checkboxes on page 3: Option 1: Submit the attestation online at the Cybersecurity and Infrastructure Security Agency Repository for Software Attestations and Artifacts (RSAA) portal. Option 2: Only use GSA Form 7700 submit it to a GSA specific email account. What this means to me is that if Option 1 is checked then Form 7700 is effectively a trigger mechanism for GSA to go lookup an existing attestation in RSAA. However, if Option 2 is checked, it would be interesting to know if GSA is taking that PDF and entering it into RSAA on behalf of the vendor. Option 2 also implies that a vendor may not have to attest multiple times for the same software product/version, but seemingly will have to submit multiple disparate forms to each part of the government. As we continue to see discussion about harmonizing #cybersecurity regulations, this is a great example where the government could have simply mandated using CISA RSAA. Instead, vendors will find themselves having to report using GSA Form 7700 for something through a GSA contract vehicle, and speculatively, a different form through NASA SEWP, and a different form for Dept of State, and different form for.... https://lnkd.in/eEDA-S8F If you haven't started to get serious about #software provenance ahead of the all-of-government mandate coming in September, now is a great time to start evaluating your #devsecops policies and procedures!

31

1 Comment

🚀"The Identity Navigator" Podcast - New Episode Alert🚀 Episode Title: #17 Continuous Access Evaluation and Twosense - fascinating domain and a wonderful product Some call it continuous MFA, some call it continuous access evaluation, but it's starting to become part of the enterprise security. This can tie back into NIST, Zero Trust Architecture or in  PCI compliance.   It’s just not a different form of MFA, it is more then that and Twosense is leading that space. They can be found online at www.twosense.ai as well as on LinkedIn Tune in now and lets learn more about Continuous Access Evaluation 🎧🔍 https://lnkd.in/ePD9bnjV #TheIdentityNavigator #IAM #Podcast #TechTalk #identityandaccessmanagement #mfa #continuosaccessevaulation

37

1 Comment

In my latest blog post, I discuss the role of weak fingerprinting signals in the context of bot and fraud detection. I use the example of language-related signals to illustrate how even signals that may look insignificant can be leveraged to detect inconsistencies introduced by bot frameworks and anti-detect browsers. https://lnkd.in/eZ2hcKeH

35

4 Comments

Thoughts on Just-In-Time procedures and NIST SP 800-171 / #CMMC compliance... At Kieri Solutions - Authorized C3PAO , we figured out that people follow procedures best when they 𝘢𝘳𝘦𝘯'𝘵 𝘱𝘳𝘰𝘤𝘦𝘥𝘶𝘳𝘦𝘴. ??? Let me explain. You're onboarding a new user. To be compliant with #CMMC, your onboarding team needs to go through a convoluted process involving getting details about the new user, verifying NDA, background checks, training, requesting permissions, justifying permissions, reviewing permissions, authorizing permissions, creating accounts, creating records of the accounts, creating records of the permissions for the accounts, assigning expiration dates for each account, setting up a laptop, authorizing the laptop...!!! It goes on and on. If your strategy is to tell your HR and IT team that they need to perfectly follow a 70 step process on page 19 of ye old 𝐈𝐓_𝐏𝐫𝐨𝐜𝐞𝐝𝐮𝐫𝐞𝐬_𝐌𝐚𝐧𝐮𝐚𝐥, 𝘺𝘰𝘶 𝘮𝘪𝘨𝘩𝘵 𝘢𝘴 𝘸𝘦𝘭𝘭 𝘱𝘢𝘤𝘬 𝘶𝘱 𝘺𝘰𝘶𝘳 𝘣𝘢𝘨𝘴 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸. The error rate will be upwards of 80%, unless you nag and threaten 😡 everyone constantly, in which case you might get down to an error rate of 30% (and your team will quit). Instead, if you use a combination of a well-designed Access Request Form and an Account Management database, all your team needs to do is remember to start with the correct form. 📝 The form should have fields and just-in-time instructions for each step of the process between HR and your IT Department. All your team needs to do is fill out each field in the form and they will complete the background screening, training, permissions, justifications, etc. naturally without nagging. Then, a well designed Account Management database helps your team manage the accounts long-term by including checks ◻️ for commonly-forgotten steps (like user agreements), next-review dates, annual training refresher dates, mapping the user to their supervisor, granular "should-be" permissions for both digital systems and facilities, and historic authorization notes. The last step for perfect procedures is a regular review to look for and fix errors. But again, if you want to be successful, don't expect your team to remember your dusty policies and procedures book in the corner. Instead, use a scheduled task, a ticket, or a checklist with just-in-time instructions to make sure that the review gets done. Pro-tip: next-review-dates are an excellent way to spread this task across time, instead of trying to do it all in one lump. Are your compliance policies and processes working for you, or against you? There is a better way. Use thoughtful design in your compliance system to reduce errors and streamline functionality. Screenshot below is from the Kieri Compliance Documentation's Account Management Database, showing some of the magic of our full-featured 800-171 / CMMC Level 2 compliance program. I'll put the link in comments, for anyone that is interested.

54

5 Comments

SEC 8-K Item 1.05: Sonic Automotive Inc. Reports Cybersecurity Incident Cybersecurity professionals, take note: Sonic Automotive Inc. (NYSE: SAH) has filed an SEC Form 8-K disclosing a material cybersecurity incident under Item 1.05. Here's what we know: • Unauthorized access to certain systems and data occurred • The breach was detected through monitoring systems • Immediate containment and mitigation efforts were initiated • Law enforcement and cybersecurity experts are involved in the investigation While specific details about the extent of the breach are limited, this filing underscores the importance of robust cybersecurity measures and prompt disclosure. For more information, you can review the full SEC filing here: https://lnkd.in/gcBAvY2u #Cybersecurity #SECFiling #DataBreach #RiskManagement

5

Worried that engineers in your organization copy production databases to their development environment? I'm excited to share the new Sentra 101 video! Check it out to learn how Sentra helps organizations institute security controls that stay with the data no matter where it goes.

26

1 Comment

Do you notice anything wrong with the table below? (Hint: this has nothing to do with fantastic analytics Richard Stiennon is doing 🙂). Security testing is not a line item here. Instead, the security testing is thinly distributed into various categories such as "Risk Assessment," "Continuous Monitoring," "Cybersecurity Supply Chain," etc. Not calling out Security Testing explicitly is a massive issue with National Institute of Standards and Technology (NIST) and other frameworks. This contributes to the perception that security testing is part of compliance, rather than breach prevention and continuous improvement.

9

1 Comment

Apple accounts are used in mobile forensics for sideloading third-party apps such as our own low-level extraction agent. Enrolling an Apple ID into Apple Developer Program has tangible benefits for experts, but are they worth the investment? Some years back, it was a reassuring “yes”. Today, it’s not as simple. Let’s delve into the benefits and limitations of Apple Developer accounts in the context of mobile forensics. https://lnkd.in/emCtPWmK #dfir #apple

15

1 Comment

Fascinating ruling from the US Supreme Court on the Cybersecurity Disclosure process. The only way organizations can tell the truth is to know what the truth is. The DVMS Institute NIST Cybersecurity Framework - Digital Value Management System® Publications and Certification Training Programs teach organizations "HOW TO" operationalize the Governance, Identify, Detect, Protect, Respond, and Recovery functions of the NIST Cybersecurity Framework (NIST-CSF). The programs also teach organizations "HOW TO" operationalize a Digital Value Management Overlay System™ (DVMS) capable of extending the NIST-CSF capabilities to include the management of organizational Culture, Structures (i.e., silos), Skills (including leadership), and Business Systems to deliver the Trusted, Resilient, and Auditable outcomes government regulators expect. It's time to learn the "TRUTH" about your organizational cybersecurity risk and implement the capabilities that will enable you to deliver the Trusted, Resilient, and Auditable outcomes government regulators expect. #nistcybersecurityframework #dvms #digitalvaluemanagement

12

3 Comments

Discipline. Focus. Obsessive attention to delivering value to customers by getting them into production at light speed. Solving their business problems at massive scale. The list of reasons that gold standard investors want to be a part of Traceable’s story is long. A lot of companies in security solutions are struggling to score a financial lifeline or find a viable exit path - it is rough out here. But, Traceable is clearly here for the long haul. Results always bear out the truth - and our results are truly speaking for themselves. Proud and humbled to be a part of this incredible management team and company.

30

1 Comment

I recently posted about the importance of using FIDO2 Security Keys (e.g., yubikey) for improving security and making it easier on your users. Today NIST put out a supplemental white paper allowing the use of Passkeys (for AAL2 not 3). They are called synchable authenticators, because unlike hardware keys, the private keys can be synced across multiple devices using cloud services (like iCloud, 1Password etc). Previously, this was against NIST 800-63 guidelines- only hardware-based keys were allowed before. They rightly state that in order to use synchable authenticators, certain protections should be in place such as controlled device enrollment, device assurance, and ensuring the keys are protected locally using a PIN/password or biometrics. While there are certainly trade offs to using passkeys over hardware keys, this is a huge step forward for lowering the barrier of entry for FIDO2 adoption. #LetThereBePassKeys

6

1 Comment

An interesting case of ICS (Industrial control system hacking) this would likely not have happened if the routers/gateways had used strong certificat based authentication. Now is the time to secure your ICS networks. #iec62443

4

Why we practice “Give it Away” here at Practical Assurance: I’ve mapped out my entire decades-long experience in compliance into our free SOC 2 Open Source Project. (https://lnkd.in/edPf2Bmf) Most entrepreneurs would say I should charge for it — and we did for several years — but not anymore. Why? I felt it was more important to just give it away my SOC 2 preparation expertise because I know it will have a far greater impact that way, giving more companies clarity and a roadmap to become compliant. And truthfully, I don’t believe it makes sense for startups or small businesses to pay for help in the early stages of an audit. If you have someone on your team experienced in compliance, our SOC 2 roadmap is all you need to guide the process. If you don’t have experience, then it helps you understand what to do and how to do it. And either way, you still need to do the work, but something like this can be a guide. The greater opportunity I saw in is that what companies DO need in the process is an external pentester (you can’t do internal pentests for a SOC 2 - it must be an objective outside tester). Not only that, but a pentester that understands the greater objective of SOC 2 compliance (vs. simply conducting a pentest). It’s why our pentesting process is uniquely different and disrupting the way testing has traditionally been done. We scope the pentest to fit the objectives of each company’s audit, to meet what your auditors will require, and in a timeline that aligns to your audit. Something else we decided to do because we know that one of the biggest reason to get a SOC 2 is to build trust with your customers, we tailor the pentest report to be customer-friendly, showing them a clean and easy-to-understand report after your remediation is complete (no one wants to share a messy red report). So while we have deep expertise in SOC 2, it’s not our main business anymore. When we pivoted exclusively to providing pentests risk-adjusted for startups and SMBs, we decided to simply give away our SOC 2 preparation roadmap in our new free SOC 2 Open Source Project. We’d rather make that information readily available to help out ANY company beginning their preparations, and if they find it useful, we know they may consider hiring us as their pentesters. We believe it’s the single BEST way we can show the level of value and depths we go to before a customer ever pays a dime to us for a pentest. Lead with real value, do the right thing for your customers, and you build rapport that matters with your customers. 

3

Uncover the hidden dangers of SVG files and learn how to defend against XXE vulnerabilities. #svgfiles #codebase #xxe

2