Tom Conner

A vulnerability has been identified, CVE-2024-27322, in the R programming language that permits arbitrary code execution by deserializing untrusted data. CERT Coordination Center (CERT/CC) has issued an advisory for CVE-2024-27322, cautioning against arbitrary code execution via malicious RDS or RDX files. What should you do? ⬆️ Update R to version 4.4.0 or later promptly. ⛔Until then, avoid interaction with untrusted RDS files or packages to mitigate risks. There is currently no public proof-of-concept or exploitation evidence available. https://bit.ly/44t7vFt

10

Are current remediation efforts enough? We measured the percent change in the number of open vulnerabilities each month for each firm. Taken together, these monthly measures reveal whether security exposures are piling up... Read the full report: https://lnkd.in/e4EAeQ6v

1

Thoughts on Just-In-Time procedures and NIST SP 800-171 / #CMMC compliance... At Kieri Solutions - Authorized C3PAO , we figured out that people follow procedures best when they 𝘢𝘳𝘦𝘯'𝘵 𝘱𝘳𝘰𝘤𝘦𝘥𝘶𝘳𝘦𝘴. ??? Let me explain. You're onboarding a new user. To be compliant with #CMMC, your onboarding team needs to go through a convoluted process involving getting details about the new user, verifying NDA, background checks, training, requesting permissions, justifying permissions, reviewing permissions, authorizing permissions, creating accounts, creating records of the accounts, creating records of the permissions for the accounts, assigning expiration dates for each account, setting up a laptop, authorizing the laptop...!!! It goes on and on. If your strategy is to tell your HR and IT team that they need to perfectly follow a 70 step process on page 19 of ye old 𝐈𝐓_𝐏𝐫𝐨𝐜𝐞𝐝𝐮𝐫𝐞𝐬_𝐌𝐚𝐧𝐮𝐚𝐥, 𝘺𝘰𝘶 𝘮𝘪𝘨𝘩𝘵 𝘢𝘴 𝘸𝘦𝘭𝘭 𝘱𝘢𝘤𝘬 𝘶𝘱 𝘺𝘰𝘶𝘳 𝘣𝘢𝘨𝘴 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸. The error rate will be upwards of 80%, unless you nag and threaten 😡 everyone constantly, in which case you might get down to an error rate of 30% (and your team will quit). Instead, if you use a combination of a well-designed Access Request Form and an Account Management database, all your team needs to do is remember to start with the correct form. 📝 The form should have fields and just-in-time instructions for each step of the process between HR and your IT Department. All your team needs to do is fill out each field in the form and they will complete the background screening, training, permissions, justifications, etc. naturally without nagging. Then, a well designed Account Management database helps your team manage the accounts long-term by including checks ◻️ for commonly-forgotten steps (like user agreements), next-review dates, annual training refresher dates, mapping the user to their supervisor, granular "should-be" permissions for both digital systems and facilities, and historic authorization notes. The last step for perfect procedures is a regular review to look for and fix errors. But again, if you want to be successful, don't expect your team to remember your dusty policies and procedures book in the corner. Instead, use a scheduled task, a ticket, or a checklist with just-in-time instructions to make sure that the review gets done. Pro-tip: next-review-dates are an excellent way to spread this task across time, instead of trying to do it all in one lump. Are your compliance policies and processes working for you, or against you? There is a better way. Use thoughtful design in your compliance system to reduce errors and streamline functionality. Screenshot below is from the Kieri Compliance Documentation's Account Management Database, showing some of the magic of our full-featured 800-171 / CMMC Level 2 compliance program. I'll put the link in comments, for anyone that is interested.

54

5 Comments

Connect with Jonathan Baker, Center for Threat-Informed Defense at MITRE Engenuity on Thursday, July 11th at SecureIT New York! Join us for a session that will explore how to measure, maximize, and mature your threat-informed defense. Discover how to identify areas for improvement so that you can make better investments and strategic decisions to strengthen your defenses. Register Now ➡ https://bit.ly/3uQTVON #CSOSecureIT #CSOSecureITNewYork #CSOevents #RiskManagement #cybersecurity

4

There's a pretty advanced "detection in depth" (I like that name) feature I've been working on for EXPMON system for PDF zero-day exploit detection. Currently on private test, will roll out to https://pub.expmon.com when good to go. This was inspried by my personal witness at PWN2OWN this year where Adobe Reader once again got easily exploited. There're SO MANY need to be done/innovated from exploit detection perspective. Detection-in-depth in PDF is super challenging. The PDF on Adobe Reader is like a browser (JavaScript) + complicated file format + various undocumented features, combined.. Sigh.. #expmon #zeroday #exploit #detection #pdf #adobe

18

2 Comments

🇨🇳 RED ALERT: 𝑪𝒐𝒖𝒏𝒕𝒆𝒓𝒊𝒏𝒈 𝒕𝒉𝒆 𝑪𝒚𝒃𝒆𝒓𝒕𝒉𝒓𝒆𝒂𝒕 𝒇𝒓𝒐𝒎 𝑪𝒉𝒊𝒏𝒂 - 🏛️ United States House Committee on Oversight and Accountability Subcommittee on Cybersecurity, Information Technology, and Government Innovation. The panel discussion focused on cyber warfare threats, particularly those orchestrated by the 𝑷𝒆𝒐𝒑𝒍𝒆'𝒔 𝑹𝒆𝒑𝒖𝒃𝒍𝒊𝒄 𝒐𝒇 𝑪𝒉𝒊𝒏𝒂 (𝑷𝑹𝑪), against the United States' critical infrastructure. ✅𝗖𝗥𝗜𝗧𝗜𝗖𝗔𝗟 𝗥𝗘𝗖𝗢𝗠𝗠𝗘𝗡𝗗𝗔𝗧𝗜𝗢𝗡𝗦 📍𝗙𝗲𝗱𝗲𝗿𝗮𝗹 𝘀𝘂𝗽𝗽𝗼𝗿𝘁 𝘀𝗵𝗼𝘂𝗹𝗱 𝗯𝗲 𝗶𝗻𝗰𝗿𝗲𝗮𝘀𝗲𝗱 to develop and replace outdated technology in critical infrastructure with secure alternatives. 📍𝗣𝗿𝗼𝗺𝗼𝘁𝗲 𝗮𝗻𝗱 𝗶𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁 President Biden's national cybersecurity strategy. 📍𝗔𝘀𝘀𝗶𝘀𝘁 𝗮𝗹𝗹𝗶𝗲𝘀 in resolving cyber incidents by engaging in *proactive international diplomacy.* 📍𝗜𝗻𝘃𝗲𝘀𝘁 𝗶𝗻 𝗔𝗜 𝗮𝗻𝗱 𝗾𝘂𝗮𝗻𝘁𝘂𝗺 𝗰𝗼𝗺𝗽𝘂𝘁𝗶𝗻𝗴 𝗿𝗲𝘀𝗲𝗮𝗿𝗰𝗵 to improve cyber defenses, recognizing the potential of these technologies to detect and mitigate attacks. 📍𝗣𝗿𝗼𝘃𝗶𝗱𝗲 𝗴𝘂𝗶𝗱𝗮𝗻𝗰𝗲 𝘁𝗼 𝗻𝗼𝗻-𝗳𝗲𝗱𝗲𝗿𝗮𝗹 𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀, clarify protocols, and support victims of cybercrime instead of imposing punishment. 📍𝗖𝗼𝗻𝘀𝗶𝗱𝗲𝗿 𝗿𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗮𝗻𝗱 𝗳𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝘀𝘁𝗿𝗮𝘁𝗲𝗴𝗶𝗲𝘀 to incentivize the removal of obsolete technologies and encourage updated and secure systems. ✅𝗞𝗘𝗬 𝗤𝗨𝗢𝗧𝗘𝗦 𝗙𝗥𝗢𝗠 𝗧𝗛𝗘 𝗛𝗘𝗔𝗥𝗜𝗡𝗚: "𝑇ℎ𝑒𝑠𝑒 𝑎𝑡𝑡𝑎𝑐𝑘𝑠 𝑜𝑛 𝑜𝑢𝑟 𝑐𝑟𝑖𝑡𝑖𝑐𝑎𝑙 𝑖𝑛𝑓𝑟𝑎𝑠𝑡𝑟𝑢𝑐𝑡𝑢𝑟𝑒 𝑎𝑟𝑒 𝑛𝑜𝑡 𝑗𝑢𝑠𝑡 𝑖𝑛𝑐𝑖𝑑𝑒𝑛𝑡𝑠 𝑜𝑓 𝑐𝑦𝑏𝑒𝑟𝑐𝑟𝑖𝑚𝑒 𝑜𝑟 𝑒𝑠𝑝𝑖𝑜𝑛𝑎𝑔𝑒; 𝑡ℎ𝑒𝑦 𝑎𝑟𝑒 𝑑𝑒𝑙𝑖𝑏𝑒𝑟𝑎𝑡𝑒 𝑎𝑛𝑑 𝑐𝑎𝑙𝑐𝑢𝑙𝑎𝑡𝑒𝑑 𝑠𝑡𝑟𝑎𝑡𝑒𝑔𝑖𝑒𝑠 𝑒𝑚𝑝𝑙𝑜𝑦𝑒𝑑 𝑏𝑦 𝑡ℎ𝑒 𝐶ℎ𝑖𝑛𝑒𝑠𝑒 𝑔𝑜𝑣𝑒𝑟𝑛𝑚𝑒𝑛𝑡 𝑎𝑖𝑚𝑒𝑑 𝑎𝑡 𝑑𝑒𝑠𝑡𝑎𝑏𝑖𝑙𝑖𝑧𝑖𝑛𝑔 𝑜𝑢𝑟 𝑐𝑜𝑛𝑓𝑖𝑑𝑒𝑛𝑐𝑒 𝑎𝑛𝑑 𝑤𝑖𝑙𝑙𝑖𝑛𝑔𝑛𝑒𝑠𝑠 𝑡𝑜 ℎ𝑒𝑙𝑝 𝑚𝑎𝑖𝑛𝑡𝑎𝑖𝑛 𝑡ℎ𝑒 𝑝𝑒𝑎𝑐𝑒𝑓𝑢𝑙 𝑤𝑜𝑟𝑙𝑑 𝑜𝑟𝑑𝑒𝑟." ~ Rob Joyce, Former Special Assistant to the President and The White House Cybersecurity Coordinator. "𝐼𝑡 𝑖𝑠 𝑒𝑠𝑡𝑖𝑚𝑎𝑡𝑒𝑑 𝑡ℎ𝑎𝑡 80% 𝑜𝑓 𝐴𝑚𝑒𝑟𝑖𝑐𝑎𝑛 𝑎𝑑𝑢𝑙𝑡𝑠 ℎ𝑎𝑣𝑒 ℎ𝑎𝑑 𝑎𝑙𝑙 𝑜𝑓 𝑡ℎ𝑒𝑖𝑟 𝑝𝑒𝑟𝑠𝑜𝑛𝑎𝑙 𝑑𝑎𝑡𝑎 𝑠𝑡𝑜𝑙𝑒𝑛 𝑏𝑦 𝑡ℎ𝑒 𝐶𝐶𝑃" ~ William Evanina, Former Director of the National Counterintelligence and Security Center. "𝑇ℎ𝑒𝑦 𝑜𝑓𝑡𝑒𝑛 𝑟𝑒𝑠𝑒𝑎𝑟𝑐ℎ 𝑎𝑛𝑑 𝑑𝑒𝑣𝑒𝑙𝑜𝑝 𝑒𝑥𝑝𝑙𝑜𝑖𝑡𝑠 𝑓𝑜𝑟 '𝑧𝑒𝑟𝑜 𝑑𝑎𝑦' 𝑣𝑢𝑙𝑛𝑒𝑟𝑎𝑏𝑖𝑙𝑖𝑡𝑖𝑒𝑠... 𝑂𝑣𝑒𝑟 𝑡ℎ𝑒 𝑝𝑎𝑠𝑡 𝑓𝑒𝑤 𝑦𝑒𝑎𝑟𝑠, 𝑤𝑒’𝑣𝑒 𝑜𝑏𝑠𝑒𝑟𝑣𝑒𝑑 𝑡𝑎𝑟𝑔𝑒𝑡𝑒𝑑 𝑧𝑒𝑟𝑜-𝑑𝑎𝑦 𝑒𝑥𝑝𝑙𝑜𝑖𝑡𝑎𝑡𝑖𝑜𝑛 𝑜𝑓 𝑣𝑢𝑙𝑛𝑒𝑟𝑎𝑏𝑖𝑙𝑖𝑡𝑖𝑒𝑠 𝑖𝑛 𝑉𝑃𝑁, 𝑓𝑖𝑟𝑒𝑤𝑎𝑙𝑙, 𝑒𝑚𝑎𝑖𝑙 𝑠𝑒𝑐𝑢𝑟𝑖𝑡𝑦 𝑔𝑎𝑡𝑒𝑤𝑎𝑦, ℎ𝑦𝑝𝑒𝑟𝑣𝑖𝑠𝑜𝑟𝑠, 𝑎𝑛𝑑 𝑜𝑡ℎ𝑒𝑟 𝑡𝑒𝑐ℎ𝑛𝑜𝑙𝑜𝑔𝑖𝑒𝑠 𝑡ℎ𝑎𝑡 𝑑𝑜 𝑛𝑜𝑡 𝑐𝑜𝑚𝑚𝑜𝑛𝑙𝑦 𝑠𝑢𝑝𝑝𝑜𝑟𝑡 𝑒𝑛𝑑𝑝𝑜𝑖𝑛𝑡 𝑑𝑒𝑡𝑒𝑐𝑡𝑖𝑜𝑛 𝑎𝑛𝑑 𝑟𝑒𝑠𝑝𝑜𝑛𝑠𝑒 𝑠𝑜𝑙𝑢𝑡𝑖𝑜𝑛𝑠." ~ Charles Carmakal, Chief Technology Officer Mandiant (part of Google Cloud)

90

5 Comments

THIS IS WILD - EXPMON Public Detected a PDF "Zero-day" PoC in the wild Which Triggers a RCE Vulnerability In Adobe Reader! Adobe has been notified, will release full details after the vendor finishes their investigation. Please note: 1. This was detected by EXPMON Public (https://pub.expmon.com) when it's on a mission to analyze a huge public PDF sample set (check it out https://lnkd.in/guFBJTFD). I've "hidden" that particular submission since I realized this finding (to give Adobe the vendor a chance to review). 2. EXPMON system detected the crash and reported it as a potential zero-day attack (see picture). 3. This seems not to be a full working exploit, but a crafted PoC, at least. As I didn't see any payload in the sample. Currently not sure if it's malicious (say, a partial unfinished 0day exploit leaked), or non-malicious (crafted PDF sample for good-purpose PDF app testing?). 4. Anyway, this does bring an exploitable crash on the latest Adobe Reader, the root cause seems to be use-after-free. However, all are based on my brief analysis, need Adobe's confirmation. Sigh.. You never know what you will find in real-world samples! More importantly, I feel EXPMON is on a good mission to fill the industry gap - looking deeply into all the files from a vulnerability/exploit perspective. :) #expmon #zeroday #0day #exploit #threatintel #adobe #pdf

50

7 Comments

Soak in some great analysis from Ben Edwards on the state of National Institute of Standards and Technology (NIST) NVD, CVE Program and Cybersecurity and Infrastructure Security Agency's vulnrichment project... #cybersecurity #infosecurity #riskmanagement

11

Transparency in our digital infrastructure is crucial. Just as we insist on knowing the ingredients in our food, we must demand detailed 'receipts' for the complex software and hardware systems in our enterprise stack—including laptops, servers, networking devices, IoT, OT, GenAI and more.

10

1 Comment

🛡️ ISO 27001 Tip #2 reminds us to clearly outline the scope of our Information Security Management System (ISMS). Knowing what's in and what's out helps focus your security efforts where they matter most. #CyberSecurity #ISO27001 #InfoSec

6

Small business owners, this one's for you! The NIST Cybersecurity Framework offers a proven approach to managing cybersecurity risks. This free resource provides a quick start guide to help you get started. ➡️ Learn how to identify, protect, detect, respond to, and recover from cyber threats. Download the NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide today! #cybersecurity #smallbusiness #riskmanagement #NIST https://lnkd.in/gnByJvYM

20

Yesterday, CISA released two new and one updated advisories that were added to ICS[AP] Dashboards and GitHub. The following vendor mitigation recommendations were provided to help you focus on what you can do now, plan for in the future, or address with compensating security controls. ICSA-24-123-01 - CyberPower PowerPanel https://lnkd.in/eKk8myeU Vendor mitigation: CyberPower has released a new version of PowerPanel that fixes these vulnerabilities: PowerPanel Business: Update to v4.10.1 or later version ICSA-24-123-02 - Delta Electronics DIAEnergie https://lnkd.in/etuYPKN9 Vendor mitigation: Delta Electronics recommends that users update DIAEnergie v1.10.01.004 to mitigate these vulnerabilities. Users can request this version of DIAEnergie from Delta Electronics' regional sales or agents. ICSA-24-067-01 - Chirp Systems Chirp Access (Update C) https://lnkd.in/gVHFUjMw Vendor mitigation: For additional information, please see Chirp Systems statement [https://lnkd.in/eKUBykNr] or contact RealPage (Chirp Systems' parent company) via their support page [https://lnkd.in/efndE_Ci]. Links to CISA recommended mitigations: Control systems security recommended practices: https://lnkd.in/e6Zruc2n Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies: https://lnkd.in/e7Gsjqmy Proactive defense of ICS assets: https://lnkd.in/gdcn2BS ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies: https://lnkd.in/erwz7vvb Recognizing and Avoiding Email Scams: https://lnkd.in/e-Fbr_kX Avoiding Social Engineering and Phishing Attacks: https://lnkd.in/e7mffdqc #vulnerabilitymanagement #mitigation #icssecurity #otsecurity #cybersecurity

3

I have had several industry professionals reach out to me today with the general question of "Does Cyolo have access to any sensitive customer credential, application or resource data in a test, QA or production environment that could put customers at risk if it were compromised". My response to them is as follows. Cyolo has no access to and has no need to be entrusted with any of this data because we are truly a ZERO Trust design (and I am not referring to NIST SP 800-207). We are not and never will be a Vendor Trust design where a vendor is entrusted with or has access to any of this customer information. (And there is a significant difference, as past breaches have shown). This means Cyolo has ZERO Access to any sensitive customer data in any environment (Test, QA, Production) in any location, be it on their premise, in a data center, within the cloud or anywhere else. This information is controlled, managed, maintained and only accessible by the customer. I hope this helps others understand the value of what true ZERO Trust and not Vendor Trust design is. #zerotrust #vendortrust #securitybydesign

27

I think the most important forensics question to ask during a breach investigation is "why did this happen?" We always get the "what" trickled truthed out over time (usually after attackers leak things to disprove the initial rosey public relations non-answers from the target). And when I say "why" I am looking for the real root cause. Were security controls treated as check boxes and not rigorously implemented and validated? Was the team rushed due to practical issues like funding or artificial deadlines to keep the bureaucracy happy? Is the tech stack they built on fundamentally insecure due to design flaws, lack of proper  testing, cutting corners, slow response on vulnerability management, or supply chain uncertainty? And so on. I think people are afraid of asking why because no one wants to face the hard truths. That's why we get Target-level attacks several times a week now and it's normalized. This week was AT&T text message metadata , Advanced Auto Parts, Evolve Bank, and more. Data for millions of customers stolen in each case. This situation is what failure on cybersecurity looks like and is unacceptable. Without the why, we can't begin to heal. And reflexive action for the sake of action can't fix anything without the underlying the actual why.

5

My book 📚 "Incident Response with Threat Intelligence" is also included in this promotion 🤓

65

7 Comments