What Smart CISOs and Mature Orgs Get That Others Don’t About Cyber Compliance – Matt Coose – PSW #814
Matt Coose is the founder and CEO of cybersecurity compliance firm Qmulos, previously the director of Federal Network Security for the National Cyber Security Division of the (DHS).
CISOs carry the ultimate burden and weight of compliance and reporting and are often the last buck. Says Coose, best-of-breed is better described as best-to-bleed-the-budget: it’s a bottom-up, tech-first, reactive approach for acquiring technology as opposed to managing risk. Coose shares his top considerations below for how CISOs can navigate the crowded market of cybersecurity tools when cost is highly scrutinized, but regulations keep growing.
Platforms are what every vendor dreams of being called, but no platform does it all, says Coose.
Coose shares what smart CISOs and mature organizations understand, that others don’t:
• There’s no “buying their way out of security issues or into a better risk posture.” They understand the need to evolve to a top-down, risk-driven, inherently business-aligned, dynamically adaptable, and evidence-based security management strategy.
• That looking at technology choices through the lens of risk controls (and the related data provided by technology that implements those controls) enables credible and transparent strategic tech portfolio management decisions that are immune to vendor preferences or the latest market(ing) fads.
• The need for meaningful security and risk measurement and the difference between leading and lagging indicators.
• The original intent of security and regulatory compliance as a model for proactive and consistent risk management (leading indicator), not just a historical reporting and audit function (lagging indicator).
• That managing risk, compliance, and security as distinct and separate functions is not only wasteful and inefficient, but denies the enterprise the ability to cross-leverage significant people, process, and technology investments
Matt is a long-time IT and cybersecurity executive with extensive experience in operational cybersecurity and large-scale security and risk management programs. After graduating from West Point, Matt served as an Army pilot, and worked with both large and small businesses in the private sector before transitioning to government. Prior to founding Qmulos, he served as the Senior Executive and Director of Federal Network Security at DHS, where he led the transformation of FISMA across the Executive Branch of the U.S. Government. While working with White House staff, he jointly conceived and initiated the Continuous Diagnostics and Mitigation (CDM) Program, a multi-billion dollar cybersecurity continuous monitoring program.
Join our cybersecurity community on Discord! Connect directly with our expert hosts, join discussions with fellow audience members, and customize your notifications to receive alerts every time an episode of your favorite show publishes. Get your invite at securityweekly.com/discord!
MS Breach, printers, Android hacking – PSW #814
In the Security News: Don’t expose your supercomputer, auth bypass and command injection FTW, just patch it, using OSQuery against you, massive credential stuffing, backdoors in Harmony, looking at Android, so basically I am licensing my printer, hacking Tesla, injecting keystrokes over Bluetooth, and remembering the work of David L. Mills.
Security Weekly listeners: Cyber threats are evolving — is your organization keeping up? The 2023 Cybersecurity Year in Review is Here! Uncover the latest challenges and strategic responses in CRA's 2023 Cybersecurity Year in Review – sponsored by RSA Conference. From the impact of generative AI to the risks of ransomware to navigating new SEC rulings, get ahead for 2024 with your free copy. Download the report at securityweekly.com/yearinreview2023
Paul Asadoorian
- CVE-2023-43786 & CVE-2023-43787 Vulns in libX11: All You Need To Know
Amazing write-ups (check out part 2 as well). Thing is though the CVEs point back to October 2023, which is when I believe we covered these vulnerabilities.
- Critical Bugs in NVIDIA Super Computer BMCs
I saw some advice on this one: "Don't put your supercomputer on the Internet". So, if we just don't connect our computers to the Internet, they will be safe. Ridiculous. The problem is in the BMC, and if you are going to use the BMC, it is probably connected to some network. Attackers could get on this network. The solution is to patch your BMC firmware/software.
- Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN
Web authentication bypass plus authenticated command injection FTW!
- Android-based PAX POS vulnerabilities (Part 1) – STM Cyber Blog
Some really interesting Android hacks and vulnerabilities in here, mostly due to poor implementations and code. For example, you can really harden Android, and in some cases make it next to impossible to root or mess with bootloaders, but as usual, the devils in the implementation.
- It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly…
Cool research and nicely written summary: "At this point in time, an attacker can easily cause a denial of service using this exploit, but as SonicWall noted in its advisories, a potential for remote code execution exists. While it may be possible to devise an exploit that can execute arbitrary commands, additional research is needed to overcome several challenges, including PIE, ASLR, and stack canaries. Perhaps a bigger challenge for an attacker is determining in advance what firmware and hardware versions a particular target is using, as the exploit must be tailored to these parameters. Since no technique is currently known for remotely fingerprinting SonicWall firewalls, the likelihood of attackers leveraging RCE is, in our estimation, still low. Regardless, taking the appropriate precautions to secure your devices will ensure they don’t fall victim to a potentially painful DoS attack" - I think one aspect you must include when triaging these vulnerabilities is the difficult and impact of the firmware upgrade. While difficult to determine ahead of actually installing the update, if its easy and low operational risk, just apply the patch. Don't get hung up on the exploitability, as that could change at any time and I'd rather you be patched than scrambling to update all of your appliances. Also, some Linux distributions do a great job of collecting and posting user feedback on how well, or not so well, the update went for you. This crowdsourcing of the update experience is amazing, and I wish more vendors did this (unless they do and I just don't check the support forums).
- Think Offensive – Leverage OSQuery for Discovery and Enumeration
Interesting article as it describes using OSQuery as an attacker to gain knowledge about the hosts and the environment. Conceivably you could evade detection using this method as many monitor the obvious enumeration attempts (ala Bloudhound), but may not look at access attempts and named pipes used to access data from OSQuery.
- dir-815
If you come across a D-Link using the dir815_v1.01SSb08.bin firmware, its vulnerable to this. Not certain if there is a CVE, but exploit looks legit.
- Inside the Massive Naz.API Credential Stuffing List
Now is a good time to change passwords, implement and configure MFA, use a password manager and some of its features (but not the feature where it stores your 2FA auth codes). Also, your Flipper Zero can be enrolled as a U2F device, which is handy.
- Microsoft network breached through password-spraying by Russia-state hackers
- A backdoor with a cryptowallet stealer inside cracked macOS software
- Inventor of NTP protocol that keeps time on billions of devices dies at age 85
So much of the software and protocols used today were created decades ago by smart people such as David L. Mills: "In the 1970s, during his tenure at COMSAT and involvement with ARPANET (the precursor to the Internet), Mills first identified the need for synchronized time across computer networks. His solution aligned computers to within tens of milliseconds. NTP now operates on billions of devices worldwide, coordinating time across every continent, and has become a cornerstone of modern digital infrastructure."
- Chinese hackers quietly exploited a VMware zero-day for two years
- Huawei Claims They Have Something Better Than The Linux Kernel
"He said that their company had made “a true OS this time which installs full-stack self-developed technologies and doesn't rely upon the U.S. traditional Linux cores”." - And that won't contain any backdoors, right? How would we know or check? ;)
- US Agencies Issue Cybersecurity Guide in Response to Cybercriminals Targeting Water Systems
- Hacking Credit Cards By Using Magspoof With Flipper Zero.
This is a neat trick, and I have one, technique was released 8 years ago by Samy :) I will say while some of the Flipper things are old, it's neat to have them all in one device, even with add-ons.
- Bigpanzi Exposed: The Hidden Cyber Threat Behind Your Set-Top Box
If you are looking to evaluate your Android devices hunt around for ADB Android forensics cheat sheets. They break out all of the adb commands you'll need to start validating your Android install. Also, sniffing the network and looking at the traffic is another way (or Pi-Hole). Right now, its a very manual process... I'm considering rooting some of my Android TV devices (if possible) and then using that access to remove the crapware in hopes 1) I can reduce the attack surface 2) They will run better.
- Hi, My Name is Keyboard
I got this running on one of my systems. I say running and not working successfully because these are two very different things. My Pixel 2 updated to Android 11 at some point, and I believe this device is not vulnerable as it asks me if I want to allow another BT device to attach.
Jeff Man
- Mother of all breaches reveals 26 billion records: what we know so far
Nothing to see here. The supermassive leak contains data from numerous previous breaches, comprising an astounding 12 terabytes of information, spanning over a mind-boggling 26 billion records. The leak, which contains LinkedIn, Twitter, Weibo, Tencent, and other platforms’ user data, is almost certainly the largest ever discovered.
- Subway Sandwich Chain Investigating Ransomware Group’s Claims
You'd think this was a PCI issue, but apparently it's not. or is it???
- Trello API abused to link email addresses to 15 million accounts
An exposed Trello API allows linking private email addresses with Trello accounts, enabling the creation of millions of data profiles containing both public and private information.
- loanDepot cyberattack causes data breach for 16.6 million people
Mortgage lender loanDepot says that approximately 16.6 million people had their personal information stolen in a ransomware attack disclosed earlier this month. - this one has to be PCI related.
Larry Pesce
- Alarm Panel Hack Defeats Encryption By Ignoring It
- Another Chance To Revive Your Nabaztag
- Mass exploitation of Ivanti VPNs is infecting networks around the globe
- HP CEO evokes James Bond-style hack via ink cartridges
- Docs Show FBI Pressures Cops to Keep Phone Surveillance Secrets
- Zero Day Initiative — Pwn2Own Automotive 2024 – Day One Results
- Hi, My Name is Keyboard
- Ivanti Connect Secure zero-days now under mass exploitation
