Quality Plus Consulting - Breakfast Bytes

Vulnerability management that every business decision maker needs to know about - Part 1

Felicia King and Dan Moyer of QPC Security talk about vulnerability management, patch management and all the things that business owners are generally not understanding adequately. As a result of that, you're being underserved, misled, and in some cases were lied to and ripped off.
Ultimately, many business owners are refusing to pay for what they need for adequate risk management because they don't understand what they need. In today's episode Felicia and Dan fill that gap. 
Announced on October 6, 2021, the US Department of Justice Civil Cyber-Fraud Initiative is applying the false claims act to those who:
fail to follow required cybersecurity standards
knowingly provide deficient cybersecurity products or services
misrepresent their cybersecurity practices or protocols
violate obligations to monitor and report cybersecurity incidents and breaches
Just let that sink in for a second. So, is your IT service provider really meeting that standard? I sincerely doubt it.
01:23 The difference between vulnerability management and patch management 
Holistic vulnerability management includes, but is certainly not limited to: 
Software bill of materials analysis 
Supply chain risk management 
Third-party risk management 
End-of-life software 
Asset inventory up to date 
Lifecycle management 
Continuous vulnerability assessment 
Frequency penetration tests 
Tabletop exercises 
Procurement policy 
04:38 Cybersecurity insurance applications aren’t asking JUST about patch management 
When did you have your last penetration test? 
Do you have continuous vulnerability assessment in place? 
How long are you going to go without having the patches applied in the environment? 
If you think adequate patch management can be done for $50/mo/server, you are hallucinating.
So, what’s included in patch and vulnerability management?  
05:34 Patch management 
Patches are the building blocks that are improving the software that lives on the hardware. Without software, you can't interact with the piece of hardware unless it's purely mechanical, and even then there's still improvements of usage.  
How do you manage and protect those tools of your business from threat factors? 
09:20 Third-party patches & vulnerabilities 
IT service provider proposals are telling business owners that they can patch their servers and their endpoints and automate Windows updates and some third-party patches. What are those third party applications? What about all your custom business line applications? Do you actually want your critical SQL server to have its SQL instance updated using automation? How much money does it cost you if that workload is down?
10:27 Asset management 
Do you know what you have in your environment? Do you have accurate asset management and vulnerability assessments? Simply stated:  
“You can’t secure what you don’t have an accurate inventory for.” 
It is a regulatory requirement and cybersecurity insurance requirement to adequately document and understand software dependencies in your environment. That requires a proper inventory of your hardware, software, and subcomponents of the software. This is frequently referred to as SBOM - software bill of materials. And if you think your software vendor is going to provide that information, please go ask them for that information. You will probably get a blank stare. IS security engineers can figure it out on their own.
18:48 Implementing proper procurement policies 
Does your procurement policy support your vulnerability management strategy? Does your software acquisition and implementation policy (if you even have one) support your cybersecurity insurance and regulatory requirements?
When business decision makers put pressure on an IT service provider or internal IT to implement new software without proper security protocols, vetting, and process documentation, vulnerabilities are nearly always introduced into your environment. Sometimes that comes directly from their insecure software. Sometimes it comes from the tools and connectivity they use to remote into your systems or things like API connectors that your IT is supposed to just blindly trust the software vendor to secure their software with zero validation or proof. A proper CISO on your team or through your ITSP will be able to directly vet the vendor and software itself.
You are required by cybersecurity insurance and Federal regulatory guidance to do so. It is also in your business's best interest to do so.
Be very careful looking for just certifications for someone who says they are a CISO. The majority of CISOs do not have technical chops. They are often compliance managers that cannot do the technical work. Those people have limited usefulness and will not be able to 
All of the vCISOs at QPC are hardcore technical because we understand the essential nature of that skillset being a mandatory requirement to deliver effective CISO services.
20:24 Privileged access management and privileged password management 
How do you know who has access to remote access to your systems? How many people will have access to your systems? Today, there are many IT service providers who are not disclosing their outsourced Helpdesks that are giving full administrative-level access to a customer’s back end to all those workers at the virtual live Helpdesk. Most ITSPs also fail to disclose the totality of the quantity of people that will end up with admin access to some or all of your systems.
Ask yourself. If you have 25 office personnel, why would it take 30 remote people to have admin access to your systems in order to provide competent support? Do you think it is actually possible to have a high security environment and magically keep 30 people fully up-to-speed on the exact correct configurations required in your environment and what the interaction effects are? It's not possible and will never happen. 
24:27 A procurement policy can keep a business' IT costs stable 
The number one thing that business owners complain about is the cost of maintenance. With a procurement policy in place and by working with their IT service provider and procuring anything that they do not have a full understanding of the total cost of ownership for – costs can be managed. 
Does your procurement policy support your business strategy and needs? 
34:22 Understanding the cost and time of device and software procurement 
There's also a lot of other risks that the vast majority people don't think about; they tend to only think about the budgetary risk. However, getting the strategic input from a CISO or CIO to develop an understanding of the minimum pricing floor and how that affects the total cost of ownership, can save a business not only money but time.  
SaaS can get you closer to a flat-rate cost but you may have inherited additional risk and vulnerabilities, depending on how the new technology interconnects with your systems. Additional risk factors are:
counterparty risk
structural increase in cost of doing business risk
accessibility risk (redundant access is then required and cannot be fully mitigated)
external software vendor attack vector risk that cannot be mitigated through Layer3 ACLs
takedown/contract risk
37:33 Cloud vs on-prem security 
It's still a fallacy that having your systems in the cloud is better and cheaper, incorrectly thinking they can have as good security in the cloud as they can on premise. Going to SaaS can provide a lower and more predictable TCO if the counterparty risk you accept is worth it. But picking up your servers and hosting them on someone else's infrastructure will never be less expensive. IaaS cost savings are a fallacy for the majority of businesses. The exception being massive companies with heavy DevOps needs for spinning up and down workloads quickly. Most of those items are being migrated to Kubernetes and OpenShift.
46:48 IT/IS is not a utility 
The electricity company, the water utility, garbage pickup, fire and safety, ISP – they are monopolies and uni-taskers. Whereas IT is far more complex. People tend to think that if it’s a utility, therefore it’s a commodity, and if it’s a commodity it doesn’t matter which service provider I choose. 
Business decision makers are trying to manage budget risk without understanding their requirements. They also want to have budgetary control while abdicating their involvement upon outsourcing their IT to an ITSP.  
An IT service provider can be a partner to success and can help businesses develop better business strategies IF there is regular and open communication.  
 
This is part 1 of a 2-part series on vulnerability management. Listen to Part 2 at https://qpcsecurity.podbean.com/e/vulnerability-management-with-felicia-and-dan-part-2. To learn more about QPC Security, visit us at https://www.qpcsecurity.com/
This is another resource for vulnerability management information.
https://land.fortmesa.com/vulnerability-management-101
 

Signs of insufficient networking knowledge

Scenario 1
Phone VLAN on a switch and cross connected into a Firebox with desk phones, PCs, and printers in the environment
Questions we actually got:
On Monday, we send over the list of what switch ports are for printers, which are for PCs, and which are for desk phones. Technician says that two of the three phones are not working. We use our awesome switches to find out exactly where these other phones were plugged in. The phones were plugged into the wrong switch ports. Move desk phones, phones work.
Then later, the technician runs a test for the VOIP service from a PC on the PC VLAN not from a PC connected to the phone VLAN. So the test for the VOIP service fails. Security zone profiles exist. It is not acceptable to have an allow everything network security posture. Configures needed to support desk phones are completely different from those that are required to support domain joined Windows computer assets.
 
Some ITSPs have to pay for expensive add-ons like Auvik to try to compensate for the fact that they have inadequate switching equipment with inadequate design and a sprawl that they have to inventory and keep track of. TCO comes from how much time it takes to maintain, manage, adds/moves/deletes/upgrades, troubleshoot. If I have to physically go to a site to chase some cabling, something is really wrong.
The technician in this scenario also could not believe we wanted two network cables between the switch and core router. They are not the only one. I encountered this lack of vision of understanding in another client IT director earlier in the year. If you don't know why you would have two network cables between a switch and a core router, go figure that out.
Scenario 1
Phone system with desk phones. Each desk phone has its own network cable, which is good. Phone subnet should be a separate VLAN, but the choice is made by ITSP to separate the phones using physically separate switching equipment. That is something I would never do.
Commentary provided by ITSP:
I don’t like VLANs. I would rather setup a network with physical segmentation. Results in:
Loss of visibility
Loss of network resiliency
More expensive because you have more switches to babysit and troubleshoot
So if you have 20 or 40 VLANs, so does that mean you are going to have 20 or 40 physical switches?
If you don’t have 20 VLANs then what network security do you really have?
How do you present virtual servers on the proper microsegmented security zone when you cannot transmit tagged packets?
Let’s just talk minimum VLANs that we typically see here:
SwitchOOBM
ServerOOBM
SwitchMgmt
WAPMgmt
Phone
Surveillance
CorpWired
CorpWireless
GuestWireless
HVAC
ElecMon
Chromebooks
CaptivePortal
Tier0
DCs
AppGroup1
AppGroup2
DeprecatedApps
Printer
Storage
IAM
RMM
Clearly anything over two becomes ridiculous to do with physically separate switch equipment. The days of this paradigm or strategy are long gone since cybersecurity compliance is requiring microsegmentation. And network security strategies and technical controls are some of the most effective primary and compensating controls for cybersecurity posture for all the protected assets regardless of type.

About Password Managers

More than 80% of breaches occur due to credential theft. All organizations have compliance requirements to have org-owned password management systems and MFA enforcement on accounts used by employees and contractors.
Some other needs which must be met are:
Compliance attestation documentation
Proper use of the best MFA method on a per resource basis
Aligning business continuity objectives with cybersecurity objectives
Developing procedures for staff on how to use the company password manager system properly
Aligning procedures with information security policy
Developing/enhancing information security policy
End user awareness training around credentials, MFA, password management
and more
I wrote a 16-page educational guide for clients to help them understand the complexities and challenges of password manager solutions and why this is not an easy button project. This podcast is a supplement to that whitepaper.
 
See the following supporting podcasts for additional information.
https://qpcsecurity.podbean.com/e/requirements-for-premise-hosted-assets-cybersecurity-bcdr-and-more/
 
https://qpcsecurity.podbean.com/e/how-to-achieve-compliance-for-privileged-account-management/
 
https://qpcsecurity.podbean.com/e/avoid-cybersecurity-insurance-fraud/
 
Why buy from QPC
QPC provides managed clients staff onboarding and training documentation. As we update the documentation with new procedures or enhancements, we publish the new versions of the documents to the client’s IT Training SharePoint library. We also make them available through the QPC Security portal which all M365 users have access to.
QPC creates and maintains workflows for cybersecurity insurance and compliance attestation for managed clients. Compliance attestation and the maintenance of the reports and workflows to produce the compliance attestation are mandatory for cybersecurity insurance and some Federal or State regulatory compliance. As supply chain and vendor risk management becomes more prevalent, organizations will need to provide proof of these items to customers or prospective customers as part of contractual due diligence. Organizations can scramble to compile these items on their own. Managed clients benefit from QPC’s compliance preparedness.
Access to QPC’s password manager import/export/business continuity procedures. Our expertise in password manager conversions reduce friction to staff adoption of the system.
Support customized to client’s unique needs
Strategic guidance on how to best use the tool to meet the staff’s needs while being in compliance and alignment HR, information security, and company use of technology policies
Advanced security implementation services
Reduced implementation time compared to implementation by client’s in-house IT
Compliance attestation for cybersecurity insurance
HR policies which support use of the solution; employee use policies
QPC provided password security policy
Training for end users on how to setup what kind of MFA
QPC has systems for shared MFA even when OTP is not an option for a resource client staff are accessing.
Managed clients benefit from QPC’s existing R&D investment as well as ongoing enhancements of managed functionality.
No data loss or business continuity risk in doing so. At any point a client who wishes to separate from QPC can do so. This is covered in the separation area of this document.
QPC has a strong relationship with the software vendor where the feature requests we submit are typically integrated in the product in three months. We submit feature requests for functionality for managed clients.
QPC includes additional compliance modules in the subscription which are not part of the standard direct subscription. Keep this in mind when doing price comparisons.
QPC can co-term licensing for user additions
Direct software vendor support is not designed to be anything other than break/fix
Quicker response time than direct software vendor support
QPC is able to provide enterprise level support for the product whereas a direct customer would need to have a $25,000 per year support contract in order to receive a similar level of support direct from the software vendor.
QPC can be the compliance delegated admin for clients where desired. If not desired, then the client must assign and fully train the compliance manager delegated admin. Responsibilities and recurring tasks must be assigned to that person.
QPC works with managed clients to define staff user roles and assign security policies to them. Some employees should not be accessing the password vaults unless they are on company‑owned and secured systems. We define allowed platforms, security baselines, restrict data exfiltration and more.
QPC can implement additional technical controls to prevent employees from storing passwords where they should not be stored, such as browsers. We strongly recommend technical controls and ongoing cybersecurity awareness training backed by employee policies the reduce the opportunity for storing passwords related to company assets in an unapproved manner.
QPC can provide a separate end user support system for clients where they are able to contact the password manager support via email, chat, and phone. This service is not available for direct purchasers. Direct support includes only Level 1 help desk for basic user configuration or end‑user issues at the quantity of 25 per year. Free online documentation and videos is included of course.
Onboarding, new employee training, and configuration management support is not available for direct accounts.
Business continuity
Not only should all organization or company-related credentials be stored in a company-approved password management system, but at least two individuals in every department should have modify access to any shared credentials. Password management systems which meet the security requirements and are cloud-based tend to have zero trust storage methods.
Zero trust storage is a very important concept. It means is that if a second person was not granted access to that data, it may become irretrievable. It also means that unauthorized parties cannot see your passwords or the content you store with them. That includes your service provider and the password management system hosting provider.
Business continuity also comes from techniques. For example, individuals who share a job function should always have their own unique logins and MFA into a system where possible. That is the dual-‑admin approach. A great example of that is Constant Contact, bank websites, your company UPS account, marketing automation platforms, etc. Multiple people may be sharing a job function, but each person should have their own login IDs where possible.
In the cases where a website or resource does not allow for individual credentials for multiple individuals, the use of a password manager application with shared MFA allows the shared business function staff to have secure access to the same credential with MFA enforcement on the resource. This is a critical feature for security and risk mitigation.
Separation from IT service provider
In the case the client wishes to separate from QPC, they are able to convert to a direct paid account or able to migrate their licensing to another IT service provider. No data loss will occur as long as proper offboarding procedures are followed. The procedure is quite simple. First one must pay for separate licensing. Second, the master administrator account which is like a glass-break recovery account must be transferred to the new designated personnel. This is very easy to do since QPC’s standard business continuity protocol for configuration of a managed tenant involves the inclusion of this glass-break or master recovery account.

Requirements for premise hosted assets; cybersecurity, BCDR, and more

You should not put things in the cloud unless you can secure them there at least as good as a highly competent professional would have if they had that asset on premise.
Cloud hosted assets have additional risks.
Counterparty risk
Additional outage and accessibility risk
You have less control
You have less security over the human or governmental access to your content
Zero 4th Amendment protections over that data. It's fully subject to FISA searches that the provider is required to never tell you about.
Also do NOT get sucked into the scam that cloud hosting servers is more secure than if you did them on premise or somehow more cost effective. That is sheer lunacy.
SaaS can be more cost effective and more secure. Look at Office 365 as an example. That is clearly more secure, more cost effective, and more value than a premise Exchange server. SalesForce could be better for you than running your own CRM, but then you are also fully open to their crazy policies which could rip the rug out from under one of your most business critical systems.
There is no one right answer 100% of the time. Context and artistry of security strategy are exceedingly important.
This show is about these things as well as what you must have in place to have premise hosted secure assets. I describe a Tier0 asset scenario in specific and what can easily undermine it.
 
Premise hosted password managers
It is worth noting that extremely high functionality privileged access management and identity management systems are available in a premise hosted format which are a perpetual licensing model with very low annual software maintenance fees. These systems are exceptionally valuable to IT departments and QPC has extensive experience in these platforms. They are an exceptional value to IT management functions and IT departments.
However, most organizations, even those with full-time IT departments, will not meet the requirements for self-hosting. Why? In order for a self-hosted password management system to be successful, it relies upon many factors which must be in place and be fully executed with extremely high levels of skill and security. This level of skill is outside of the technical skill level of nearly all IT departments of companies with less than 5000 employees.
If the requirements are not fully met continually for the life of use of the platform, the platform and its contents are likely to be compromised. A compromise could consist of the data exfiltration of the entire password vault database which would be catastrophic to the organization.
Baseline requirements for premise password managers
Extremely tight supply chain risk network layer security rules and management
Ability to do offline upgrades for all software and systems involved
Extremely adept underlying server, network, power infrastructure management
Rapid patch management within 48 hours or less
Always on scanning for vulnerability assessment backed by active monitoring and remediation
Active monitoring
Multiple first line backups per day with multiple encrypted offsite backups per day
Two physically disparate sites with significant server, network, power infrastructure with automatic backup generator service and redundant internet
Proficiency at managing SQL server replication over WAN links in an active/active SQL server configuration
Proficiency at maintaining active/active application server configurations and automatic failover network configurations
Absolute rigorous discipline to adhere to documented standards for vault creation, password management system administration, application updates, database system updates, OS updates, third party app updates, network layer security management across the entire internal and site-to-site connected networksAny laxity in the discipline of the IT personnel managing the system will cause it to fail to deliver the security profile required for critical assets.
Minimum of two servers involved with the addition of more servers if internet facing roles such as mobile access are desired
IT personnel’s ability to implement and maintain complex privileged access management systems
Regular security compliance and audit report reviews. This will require a CISO and/or compliance officer with significant technical skill.

Virtual Patching, Telecom Fraud, Running VM Server on NAS

I got a request to post this podcast from 12/1/2018 to podbean. Here it is.

Video management system appliance analysis

Originally aired: 11/1/2018.
I had a request to post this older podcast to Podbean, so here it is.
VMS Appliance cost analysis between the "appliance" version and the "you get a real server" version.
https://qualityplusconsulting.com/BBytes/QPCAnalysisOnAxisVideoRecorderServer.pdf

Why real server hardware is usually the most cost-effective option

I got a request to publish a podcast I did a few years back on podbean, so here it is. Originally this was from 10/19/2018.
 
Usually there is no substitute for real server hardware. Attempts to pay less for server hardware almost always end up costing you more in the long-run.
Windows 10 as of Build 1809 10/2/2018 has an IPv6 requirement. There are a bunch problems with that.
We cover the option of running an ACS Appliance instead of building your own ACS VMS using a real server. We will go into more detail about this in part 2.
You must include the cost of labor over the life of the hardware as a consideration if you are going to come up with a viable cost comparison between solutions.
We briefly touch on the option of running a VM on a Synology NAS. More about this on a later show.
 
VMS Appliance cost analysis between the "appliance" version and the "you get a real server" version.
https://qualityplusconsulting.com/BBytes/QPCAnalysisOnAxisVideoRecorderServer.pdf
 

Resources for job candidates in cybersecurity - What you need to do to be employable

Overview
Listen to the podcast or the list of these resources may not make sense to you. You cannot secure what you cannot engineer, implement, maintain, and support. Security was always infused into IT if you did IT correctly. I know. I've been doing IT since 1993 and was programming in third grade. Security was ALWAYS part of a proper strategy. 
I'm always trying to add to the team. But I find that a lot of people are just wholly unqualified to do baseline prerequisites. They get misled and sold on the idea of getting a degree in IT/IS/Cybersecurity. Unless you have mastered the items on this list, it won't matter what degree you have.
Here are some other helpful articles.
https://www.qpcsecurity.com/careers/
https://www.qpcsecurity.com/careers/cybersecurity-career-resources/
 

Right-sized software

Amazing interview with Colin Ruskin, CEO of WorkOptima, on the topic of right-sized software.
Colin has an incredible talent at being able to distill the truth of something into a catchy and memorable tagline using spot on metaphors.
Some highlights:
Can I actually use the software and benefit from it?
Floors versus software that grows with you
All features all the time, but license it at the per-user
Enterprise drama and enterprise mindset which is not really trying to sell to the SMB market and is really trying to break into the SMB market because they ran out of customers in the enterprise market.
How to evaluate software
What do you need to do in order to make it work for your transaction?
Far too few product managers are on sales calls interacting directly with customers
Every software company is behind on features the customers are asking for. Iceberg situation. Millions lines of code that no one sees and does not appreciate. You need to really be on top of it and prioritize fixing the items below the water in addition to the above the water items which are the features the customers want.
A lot of companies have acquired software companies. They have failed to keep the software developers. They have lost the knowledgebase about how this thing does what it does. Huge resistance to changing, updating the code.
What is this vendors real story? Who is this vendor actually focused on taking care of?
Exit strategy from software. Who owns the data and how are you getting it out? When you say goodbye, how are you going to get out of that system? Will you ever want this thing 20 years in the future?
Who really OWNS the content?
Are they in it for the long game or are they in it for the transaction? They are very focused on the stock market, revenue recognition model. They are so focused on stock price manipulation. They have completely lost track of and lost focus on the actual goal. Try to understand the company and management is behind the product.
4/27/2022

How to achieve compliance for privileged account management

Cybersecurity insurance requires MFA for all internal and external administrative access. How do you accomplish this?
Examples of things you might access:
switches
firewalls
servers
printers
workstations
DNS hosting
website hosting
cloud management portals
NAS
BCDR appliances
 
There are many ways to solve this problem and they are all too long to post about here, so this is what this podcast is about.- Passwordstate remote integrated proxy authentication- tiered access control- compensating controls as an alternate for MFA- access portals with MFA- privileged admin workstations- account logon restrictions- hardened network access control restrictions (microsegmentation strategies)- more
 
https://www.clickstudios.com.au/remotesitelocations/default.aspx
 

API Security and external vulnerability scanning

API Security is going to be the thing you need to be paying attention to in the next two years.
Partner with an information security officer like QPC Security to get an internal and external vulnerability scanning plan in place for your organization. A lot of vulnerability management is not possible to do with tools. It takes experience and expertise that comes from 29 years of hard work. 
 
A great API scanner https://www.wallarm.com/
 
RMM security topics/tactics
 
 
Either fund your IT security or decide to go out of business
Companies have some hard decisions to make. They are either going to continue to be in business and allocate budget to correcting gaps, or they are going to go out of business because they will find themselves uninsurable or unable to come up with the funds to rectify all their security gaps in the required allotted time.
 
Reviewing your last cybersecurity insurance application
My latest offer is to review your last completed cybersecurity insurance application. The offer is only open to business owners directly or the executive management team of an organization who would be a good fit to be a client of ours.
https://qpcsecurity.com
 
The truth about smart cities.
https://www.theguardian.com/cities/2014/dec/17/truth-smart-city-destroy-democracy-urban-thinkers-buzzphrase
 
There is an updated FAQ for the CAN-SPAM Act.
https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
 

Working with a Breach Coach/Attorney - A Primer

Cyberlaw podcast
What needs to be pre-documented for the breach attorney to be effective? And in what format?
What to do to protect yourself from outrageous fees?
What to do in order to get proper service from a breach attorney?
What are the advantages of having a pre-established relationship with a breach attorney?
What positive outcomes arise from having pre-breach meetings with a breach attorney?
3/24/2022
Spencer Pollock – Cybersecurity breach attorney
Felicia King – QPC Security, Security Architect and Information Security Officer
 
What needs to be pre-documented for the breach attorney to be effective?
Cybersecurity posture of the organization.
Compliance/legal and the technical / security
Security: identify the gaps and procedures
And in what format?
Data is everywhere.
Clients that have an IRP, data map and have a list.
Customers and data breach classification, impact / no impact
What to do to protect yourself from outrageous fees?
The more times you have to engage a breach coach in advance, the better off you are.
The more time you bake people into your team, the less time is spent on the phone when an issue occurs. This means it is less expensive and your organizational response is faster.
This is why it is critical to get the breach attorney written into the policy.
When to get the breach attorney written into the policy?
Business owner needs to be driving the breach attorney selection during the insurance application period.
Insurance policy, Beazley example. You should do a retainer with them.
Retainer: You get the benefit of cell phone, breach line.
Preparation meetings are going to be paid out of pocket. Prebreach stuff is a separate engagement, and it will usually be a lower fee.

Avoiding real estate theft, deed theft, and related scams

Check out dark patterns for scam awareness.
https://www.darkpatterns.org/
 
Avoid the new movers mailing list
Avoid putting real estate in your personal name
Use a service like Abine DeleteMe
Get a PO Box and stop having snail mail delivered as much as possible
Subscribe to paperless billing as much as possible
Harden your digital life
Get off social media and stop sharing your life in public digital media
Be aware of deed fraud and how to verify that no one has stolen your deed.
Be aware of how foreclosure rescue scams are perpetrated.
and more!
 

Attestation, scoring, evaluation, and business process in achieving improved cybersecurity posture and compliance

Joy Beland joins Felicia to discuss:
What Edwards Performance Solutions is doing in the CMMC training space
Joy's team created the CMMC assessor textbook
Many orgs have cybersecurity insurance enforcement for the first time ever
Joy's extremely wise metaphor and perspective on cybersecurity insurance (15 mins)
Transfer of risk and economic destruction
DMARC, DKIM, SPF tuning
What tools exist to help the SMB market with attestation, and establishing patterns of due care and due diligence?
IS policies and processes are required as part of the proof mechanism
Mechanisms to actually evaluate risk so that business leaders can make effective decisions
Control planes for infrastructure
Joy's sage advice: "Know what the crown jewels are."
Learn to identify wasteful practices with Gemba walks.
https://www.creativesafetysupply.com/content/PPC/gemba/index.html
CMMC 2.0 scoping analysis
https://www.linkedin.com/feed/update/urn:li:activity:6889627454466469888/
Future Feed for CMMC orgs
https://futurefeed.co/
https://qpcsecurity.podbean.com/e/the-real-reason-you-cannot-afford-to-have-a-cybersecurity-incident/
 
Special guest:
Joy Beland, a CMMC Provisional Assessor and CMMC Provisional Instructor, who works with Edwards Performance Solutions as a Senior Cybersecurity Consultant.  Joy owned an MSP for twenty-one years in Los Angeles.  She has a CISM and Security+ certification.

Integrated IT risk management - part 2

Identity theft via insecure credit APIsIntegrated IT risk management part 2

Assessments and Integrated IT Risk Management - Part 1

Problems with and limitations in many assessments
Many assessment report results from automated tools can be incomplete, incorrect, or pretzel talk
What realistic expectations should you have from a paid and unpaid assessment
There are certain security baselines simply so your organization can be insurable.
There are certain security baselines in order for your organization to be serviceable by an IT service provider.
Small organizations can easily find themselves spending $50,000 that they don't have in order to recover from a cybersecurity event.
It's not just about money. Are you sure that you can get access to all the personnel in order to get your organization back up and running in the designated time?
You need to mitigate risk proactively in order to make sure the cybersecurity event never happens.
Do not evaluate your risk based upon what you think the value of your data is. Evaluate your risk based upon whether or not you want to stay in business.

Technical Debt - a whole new perspective

10/28/2021
Cyber Matt Lee joins Felicia on Breakfast Bytes to talk about massive issues with technical debt.
Senior Director of Security and Compliance at Pax8.
You have to start with the right definitions. It’s not patch management, it is vulnerability management. You have to ZOOM in. Is your TPM up to date? Is your firmware up to date? Drivers, configurations, remove unpatchable software. Are you still susceptible to spectre and meltdown? What about SMB1, PowerShell 2.0, LLMNR, etc.? “That doesn’t have a patch, and you have to get rid of it.”
Where there is technical debt with a software code base, on a 5-year journey, you need to move to different software because the software vendors are literally incapable of updating the code base of their software. They are not actually doing the work to update the software. Their paradigms for software development lifecycle and codebase are crippling them from being able to correct issues.
Matt recommends finding SaaS platforms that suck over premise applications that suck because at least you are in the shared responsibility model.
Modern dev sec op practices are what is needed. You can build software that has a good paradigm.
We still acknowledge that there are issues with resources in the cloud as well unless an organization is willing to accept the risk of data sovereignty and the third-party risk of being disconnected from their services and data. Being disconnected from your data or being disconnected from your application because the SaaS vendor disagrees with your business model even though what you are doing is legal, this needs to be regulated out of existence. SaaS vendors are playing God.
And some things are just not cost effective in the cloud or are financially unobtainable in a SaaS format. Are you comfortable with the government accessing your data through backdoors? This is a very personal decision to each organization and individual.
15:30 mins - Matt talks about paradigm challenges that impede the ability to ever create bug free software. True SaaS should be able to iterate an outcome regardless of the hardware and OS that is accessing the system, so the software vendor does not have to plan for all the variables in their testing. This allows them to have a CICD development pipeline for their software.
Get to the nugget of what is required. An information security officer can get to what is really the intent of what the compliance requirements are asking for and translate that into what is required to fulfill that and protect the organization. Interpretation is required because too frequently the questions asked or requirements specified are not as specific or accurate as what is required.
26 mins – Vendor software development and vulnerability disclosure programs. The vendors need to tie revenue lost to the vulnerabilities. Software vendors are often setup for failure. Monolithic apps start at the top and run to the bottom of the code. Better models are where apps have microservices and each microservice can be corrected individually without a massive ordeal. A different software codebase paradigm allows for sprint teams to correct software bugs easier.
28 mins – There is no real effective possible way for many of these software vendors to fix their apps.
30 mins - It is in the C-Suite and the board to fix this. You are either going to die at the hands of threat actors, in an escalating war that we cannot win. Or you are going to start having practices that understand that this is a football game. There is no one right way to run a football play, but you cannot play with 9 players. You have no defensibility in your actions if you put only 9 players on the field when 11 are required. There are requirements and boundaries to any strategy or solution. If you don’t do the things you need to do, you don’t have defensibility.
If you are already fighting with all this massive technical debt, you are not going to ever win.
Go to tryhackme.com and find out how easy the threat actor side of this is.
 
https://tryhackme.com/

Avoid cybersecurity insurance fraud

How to avoid cybersecurity insurance fraud. If this happens to you, your claim will be denied and you will likely be uninsurable in the future including by other insurance providers.
You have to be working with an extremely operationally mature ITSP with ISOs on staff or you probably will not be able to navigate this complexity.
Great article showing a claims denial and then accompanying lawsuit for a perceived insurance fraud indicent.
https://www.insurancejournal.com/news/national/2022/07/12/675516.htm
 

Why converged NOC and SOC are so critical to security efficacy

Joining Felicia is Rui Lopes, Senior Technical Evangelist at WatchGuard Technologies. Rui was with Panda Security prior to the WatchGuard acquisition and has spent many years merging the technical with customer enablement at a level rarely seen. His efforts at WatchGuard are projects, partner support, and overall customer enablement of using the endpoint protection technology effectively.
When I listened to an interview with Fortinet's CISO regarding converged NOC/SOC, I had to reach to Rui to formalize several conversations we have had over the last 1+ years because we both have seen the need for this strategy for a very long time. 
At QPC, we have been doing converged NOC/SOC since around 2009.
Listen in to hear our breakdown about why this is such a critical strategy in today's threat landscape.
_________________________________________________________________

Act now so your emails will still be deliverable

NDAA 2021 legislation is forcing a gaps closure in SPF, DKIM, and DMARC.
This stuff is really complicated. Get some seriously competent help. I don't think most ITSPs (IT service providers) have enough experience in managing this especially in light of the inclusions of marketing automation platforms on root domains.
You cannot be driving a hole with a 20 lb sledgehammer through your email ingress filtration policies in order to accommodate for incompetently configured sender framework on behalf of your senders.
It's time to push back on their incompetence. Get your VISO involved and get policies in place such as ones that IT will not be requested to put holes in security in order to accommodate senders with bad email systems. Instead, letters will go to bad senders to tell them to get their house in order.
You need to get your own house in order in order to make sure that your emails are deliverable. Cybersecurity insurance providers are assessing this information as part of your risk profile.
Salesforce Email Service Used for Phishing Campaign | eSecurityPlanet
For more information on this topic: Email Deliverability- The Titanic Problem Headed Your Way