💡 Rebecca Herold

Cyentia Institute's Risk Retina service offers the same excellent data and analysis from our IRIS research series (https://lnkd.in/eAjaW3gx) focused on a particular sector. The goal is to support organizations in data-driven #cyberrisk assessments and decisions. I'll share some highlight stats from the Risk Retina for the Financial Services sector we produced in 2022. It focuses on 7,950 cyber loss events experienced by financial firms over a 10-year period from 2012 through 2021. We've since updated this with more recent data, and one major change is a big increase in the typical loss magnitude. If you're interested in an updated Risk Retina for #financialservices or your own sector, here's more info: https://lnkd.in/dgaF_hP8 #cyberriskquantification

Check out the draft National Institute of Standards and Technology (NIST) Assessing Risks and Impacts of AI (ARIA) Pilot Evaluation Plan, updated on May 21, 2024. Link --> https://lnkd.in/gWG8te8F It outlines the ARIA 0.1 pilot program's objectives, methodologies, and evaluation processes for assessing the risks and impacts of large language models (LLMs). Below are some of the key points. Purpose: ARIA aims to improve risk and impact assessments for AI, specifically focusing on safe and trustworthy AI technologies. Important terms and definitions include 1/ Applications: LLMs with a text-based user interface, 2/ Assessors: Trained professionals evaluating application output, 3/ Participants: Teams submitting AI applications for evaluation, 4/ Redlines: Definitions differentiating safe and unsafe application behavior, and 5/ Scenarios: Contexts for structured evaluation activities. There are three evaluation levels and methodologies 1/ Model Testing: Confirms claimed model capabilities and safeguards through scripted dialogues and assessor evaluations, 2/ Red Teaming: Identifies potential adverse outcomes and stress tests model safeguards, and 3/ Field Testing: Investigates how people interact with AI in regular use and assess their impacts in realistic settings. What are your thoughts on ARIA 0.1? Happy to schedule a call with the Protect AI team and/or we can schedule this as a topic for a MLSecOps Community podcast... let me know! #nist #ARIA #aisecurity #protectai #mlsecops

Jay Jacobs and I have been working a lot this week on the inaugural study of EPSS performance. Thought I'd share a pretty chart that Jay churned out yesterday. It addresses the question "What’s the typical pattern of exploitation activity?" As you may suspect, the answer depends on the vulnerability in question. Some vulns are continuously exploited for long periods of time. Some are just a flash in the pan. Exploits of others come in fits and starts. Some real-world examples of these patterns are demonstrated in the chart below, which depicts observed exploitation activity for five CVEs over the course of 2023. #vulnerabilitymanagement #vulnerabilities #vulnerabilityexploitation #cyberattacks

New FRTalks by Christina Catenacci: Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act https://lnkd.in/gzZ26nWj via @firstreference #internalcontrols #business #cybersecurity #security #privacy #management #risk #riskmanagement #internalcontrol #law #legal #cdnlaw #internetlaw #government #governance #Informationtechnology #PublicSector

This breach at #GlobeLife serves as a reminder that security isn't a one-time setup — it's a continuous process. Regular audits of access permissions and user identity management are essential. Orgs have to continuously evaluate their security posture to address vulnerabilities before they are exploited.

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

New Post: #CISA and @FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory #Traversal Vulnerabilities - https://lnkd.in/dAir6seU CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities 05/02/2024 02:00 PM EDT Today, CISA and the Federal Bureau of Investigation (FBI) released a joint Secure by Design Alert, Eliminating Directory Traversal Vulnerabilities in Software. This Alert was crafted in response to recent well-publicized threat actor campaigns that exploited directory traversal vulnerabilities in software (e.g., CVE-2024-1708, CVE-2024-20345) to compromise users of the software—impacting critical infrastructure sectors, including the Healthcare and Public Health Sector. Additionally, this Alert highlights the prevalence, and continued threat actor exploitation of, directory traversal defects. Currently, CISA has listed 55 directory traversal vulnerabilities in our Known Exploited Vulnerabilities (KEV) catalog. Approaches to avoid directory traversal vulnerabilities are known, yet threat actors continue to exploit these vulnerabilities which have impacted the operation of critical services, including hospital and school operations. CISA and the FBI urge software manufacturer executives to require their organizations to conduct formal testing to determine their products’ susceptibility to directory traversal vulnerabilities. For more information on recommended principles and best practices to achieve this goal, visit CISA’s Secure by Design page. To catch up on the publications in this series, visit Secure by Design Alerts. Robert Williams#News247WorldPress

Book Titled," Cyber Security for Preserving Mental Wellness and Preventing Abuses" Dear All, As the editor, I would like to call for book chapters: A good opportunity to publish your work in the form of book chapters. For more information please check the poster attached!! Abstract Deadline: 11th July 2024

Join us on Wednesday, May 29th at 8:30 AM to discover how CERT Ukraine and CISA work together to combat cyber threats! Limited tickets available - act fast! Link in bio for more details and to get tickets. #CERTUkraine #CISA #CyberDefense #Collaboration #CyberSecurity.

#SEC finalized amendments for S-P, designed to protect PII. RIAs, BDs and more must, (1) have a written incident response plan (IRP) and (2) develop procedures to notify people whose PII was improperly accessed. To quote the SEC, "The basic idea for covered firms is if you’ve got a breach, then you’ve got to notify. That’s good for investors.”" 18-24 months to implement. #ria #rias #cybersecurity

ICYMI: Office of Inspector General Report in Brief from the Alabama Medicaid Management Information Systems (MMISs) and Eligibility and Enrollment (E&E) systems security audit. The scope of the audit was limited to external facing systems and a phishing exercise (GoPhish). https://lnkd.in/emGaGWQa The OIG audit reports are always good to get a glimpse of the focus of these security audits. The response to recommendations can also be helpful for orgs struggling with some of the same issues (Starting on page 14). Key Takeaways 1) Vulnerability Management: Existing tools were not effective in detecting system flaws. 2) Software Development: Issues were not remediated prior to deploying on production systems. 3) Phishing was not successful (0 opened emails......) #healthcare #hipaa #cybersecurity #hhs #riskmanagement #risktolerance #riskassessment #criticalinfrastructure #hitrust #criticalcontrols #penetrationtesting #vulnerabilityassessment #vulnerabilitymanagement

You remember when they say, "Explain it to me like I'm five years old," well Paul Montrose CISSP, CISA, CISM, CGEIT, CRISC of Acxiom took that to heart as he delivered and won this week's BEST BAD IDEA from last week's discussion "Hacking the Conversation about Risk" on Super Cyber Friday. Please join CISO Series THIS Friday, June 21st, 2024 where our discussion will be "Hacking Generative AI Anxiety." It all starts at 1 PM ET/10 AM PT. REGISTER: https://lnkd.in/gk4pKV65 And we'll have our meetup on Discord immediately afterwards. #CISOseries #CISO #security #infosec #informationsecurity #cybersecurity

Earlier this week, the National Institute of Standards and Technology (NIST) issued interim guidance for agencies seeking to make use of ‘syncable authenticators’ (for example, passkeys) in both enterprise-facing and public-facing use cases. What does this mean? Essentially, NIST is saying that it is acceptable to use a passkey that can be shared across multiple devices as way to meet AAL2 standards for authentication. NIST acknowledges the risk that come along with syncable authenticators, many of which we spelled out in a blog post a while ago (see here - https://lnkd.in/eiDMtNtt): - How to securely store, transmit and protect the keys - How to ensure that the keys are used by the authorized person - How to implement strong authentication in shared device scenarios The challenge becomes really obvious when you look at the definition of AAL2 with the updated definition: 1. "To meet AAL2 requirements, the syncable authenticator SHALL make use of a local authentication event to unlock the locally stored key or SHALL be used with another authenticator (e.g., a user-selected password) if no local authentication mechanism is available." So essentially, you can either unlock the key with a local authenticator (implying a biometric) or with a password. What do you think the fraudsters are going to do? 2. "Private keys stored in cloud-based accounts SHALL be protected by access control mechanisms such that only the authenticated user can access their private keys in the sync fabric." Cloud-based accounts today are also primarily protected by passwords. So again I ask, what do you think the fraudsters are going to do? We built Anonybit to handle this scenario exactly. The decentralized data vault can securely store the passkey. The passkey will then get bound to the user's biometric in the decentralized cloud. To retrieve the passkey, the user needs to authenticate themselves with the biometric. This solution ensures that only the authorized person can retrieve and use the passkey. No more tradeoffs between privacy and security. Have your cake and eat it too. DM me to see it in action. #passkeys #fido2 #authentication #passwordlessauthentication #identitymanagement #innovation #datavault #decentralizedbiometrics #enterprisesecurity https://lnkd.in/e3de-DK7

Looking at the government decisions concerning unspent cybersecurity funding, it's clear that more comprehensive strategies are needed to pave the way forward for public sector digital resilience. While an immediate solution is unclear, this battle will likely continue as states and the federal government disagree over the best way to allocate these funds. It will be interesting to see how these cybersecurity grants end up being spent. Colin Wood; StateScoop #Cybersecurity #GrantFunding #PublicSector

The Federal Trade Commission (FTC) has updated the Health Breach Notification Rule (HBNR) as of April 26, 2024, to include more entities and broaden the definition of a breach. These amendments are critical for entities handling health-related services via websites, apps, or connected devices. Entities involved in digital health services should thoroughly update their cybersecurity and privacy policies to comply with these new rules. Key Changes to the Rule: * The HBNR now applies to digital health services such as health apps, expanding the definition of covered health care providers to include these platforms. * The rule extends the scope of personal health records to include more types of data. * "Breach of security" now includes any unauthorized data use, not just unauthorized disclosures. Notification Requirements: * Entities must inform individuals, the FTC, and sometimes media outlets about breaches, with the notification process varying based on the breach's size. * Details about third-party involvement must be clear in electronic notifications, which can now use various platforms. Data Handling and Privacy: * Entities are obligated to disclose their personal health record sharing practices, focusing on third-party interactions. * The rule stresses the need for contracts and continuous compliance monitoring in data-sharing arrangements. Obligations for Third-Party Service Providers: * New responsibilities require these providers to detect and report security breaches promptly. Penalties and Compliance: * Unauthorized data sharing or selling triggers breach notifications. * Misuse of data collected for specific purposes but used otherwise is considered a breach. * Unintended access by employees, even in good faith, requires notification. Transparency and Consumer Trust: * Companies must clearly articulate their data usage policies to prevent breaches. * They should regularly check their compliance status with the HBNR. * Apps should de-identify health information before sharing to reduce compliance risks. #cybersecurity #regulation #healthcare

Let's not assume that employees don't care about security. Maybe they don't believe that training can protect them or their agencies. What's the efficacy of your security awareness training? How effective is it, on average? How much should we rely on humans (human, all too human) to prevent attacks? Maybe the 20% that skip training are making the right call. If your organization's anti-phishing, endpoint, and identity protection tools can't catch an attack, what makes you think an overworked employee can be reliable, even if they care and have been trained? Isn't it high time we took a hard look at "the human firewall"? What about avoiding eyestrain? What about relieving stress? What about cutting email volume to manageable levels? Why do we still depend so heavily on email anyway? Computing is scalable. Human capacities are not. Let's stop pretending they are. #phishing #securityawarenesstraining https://lnkd.in/gbXrSgNg

New update from the National Institute of Standards and Technology (NIST) on the #NVD situation. No explanation for the situation, no definitive commitments. The last time I checked (this morning 😎) since February 12th there were over 8500 #CVE published (https://lnkd.in/dNQQMft5) and more than 8000 of them have no #CPE configuration (https://lnkd.in/duHWNjuF). I'm a bit lazy to pull out accurate stats, but for the past 10 days or so exactly one CVE (CVE-2024-3400) was fully processed. #informationsecurity #vulnerabilityassesment #vulnerabilitymanagement

Healthcare makes a tasty target for threat actors, and every day there are multiple threats to be concerned with. Today's 'hot' warning comes from U.S. Department of Health and Human Services (HHS), Federal Bureau of Investigation (FBI), and Cybersecurity and Infrastructure Security Agency (CISA) alerting that the Russia-based BlackBasta ransomware gang is actively targeting the U.S. and global healthcare sector with high-impact ransomware attacks designed to disrupt operations. The agencies urge security teams to load identified ransomware signatures into threat hunting tools and also implement cyberrisk mitigation practices as soon as possible. https://lnkd.in/gfx4QtEh #blackbasta #ransomware #healthcare #cybersecurity #security #CISO #theCUBEresearch #healthcaresector #threatactors #threathunting

Saturday morning head scratcher. Let's unpack this plan with a stroll down history lane. HITECH Act passes 2009. EMRs are mandated and implementation is rewarded through Meaningful Use and then, if the EMRs were not adopted by 2015, CMS was going to punish those who did not adopt the EMR. EMRs are now ubiquitous. And they cost a lot of money to maintain. And PHI has high value for hackers. Here are some interesting numbers: The average IT operating expense budget across approximately 4,660 hospitals is $7.8 million. This is about 3% of the average total hospital operating expense of $209 million. Where does the money go? Hardware, software, training, and ongoing fees and maintenance. How much of the budget is spent on keeping the system secure? It depends on the organization. And there is this.... Eighty-eight percent of surveyed healthcare organizations experienced at least one cyberattack in the past year (2023), leading to strained patient care and increased costs. From the article.... The American Hospital Association has long opposed cybersecurity requirements for hospitals, saying any fines or CMS reimbursement cuts would impinge health systems' ability to fight hacks. "The primary source of cyber-risk exposure facing the healthcare sector originates from vulnerabilities in third-party technology and service providers, not a hospital's primary systems," the association told Bloomberg. "The AHA supports a sectorwide approach to cyber-resiliency. We will continue to work with policymakers on an approach that doesn't result in unfunded mandates and a focus on the entire critical infrastructure of the healthcare sector." The recent Change attack was not hospital-based. And the AHA is correct in its position statements--a sector wide approach is needed. This proposal won't accomplish much. Much more needs to be done.