MacKenzie (Mac) Brown

A foreign threat actor infiltrated the Kansas City National Security Campus (KCNSC), a key manufacturing site within the National Nuclear Security Administration (NNSA), exploiting unpatched Microsoft SharePoint vulnerabilities, according to a source involved in an August incident response at the facility. The breach targeted a plant that produces the vast majority of critical non-nuclear components for US nuclear weapons under the NNSA, a semi-autonomous agency within the Department of Energy (DOE) that oversees the design, production, and maintenance of the nation’s nuclear weapons. Honeywell Federal Manufacturing & Technologies (FM&T) manages the Kansas City campus under contract to the NNSA. https://lnkd.in/giNSG9P5

22

1 Comment

“PCI SSC has seen comments…” 👀 -Assessor Newsletter, June 2025 A few weeks ago, I raised a flag about FAQ 1597 and the related infographic, where the language suggested that acceptance of lower-risk vulnerabilities wasn’t on the table. That post gained great traction and sparked important conversations in the community. Well, the PCI Security Standards Council has now responded. In their June 2025 Assessor Newsletter, they stated: ✅ Clarification (main bullet points summarized): - “Addressed” ≠ “Resolved.” - Examples of "addressed" where not an exhaustive list. - Low-risk vulnerabilities can be accepted—if justified by a Targeted Risk Analysis (TRA). - Addressing a vulnerability may mean fixing it, compensating for it, disabling it, or accepting the risk. - The TRA must be reviewed annually to ensure it still reflects the environment and risk tolerance. This clarification is welcome—but also tacit acknowledgment that feedback from assessors and the broader community (yes, some of those comments they saw were from you all) helped make it happen. 📌 Next step for the Council: Update FAQ 1597 and the DSS itself at some point to reflect this broader interpretation. The ambiguity in the official text still risks confusion and audit inconsistencies. As of this posting date, the only place this clarification exists is within the assessor newsletter. 🤨 One nitpick I will call out though— the Council called out that their original definition of “addressed” wasn’t all inclusive. However, words matter. For a reminder, this was the definition: Addressed - the entity determines whether to resolve the vulnerability or to mitigate the risk by addressing the vulnerability in another way (e.g., with a compensating control or by disabling a vulnerable service) So to be clear, their definition says resolve OR mitigate. How were we to infer that acceptance is acceptable!?! 🤷‍♂️ If you’re a QSA or manage PCI in your organization, this is a significant development. It gives you back the flexibility to treat low-risk issues rationally, as long as your TRA process is strong. Thank you to Viviana Wesley for letting me know about the publication within the newsletter! #PCIDSS #CyberSecurity #QSA #VulnerabilityManagement #GRC #PCICompliance #InfoSec #AssessorLife

214

19 Comments

If you hang around an industry long enough, you begin to see things...actions, decisions, etc...being repeated. In 2007, the team I was on began performing PCI forensic investigations, and sometimes we'd see where a technician had come into a merchant, and set the the POS devices in debug mode, leaving a clear text file of credit card numbers (CCNs) on the device. When they were done, there was no accountability regarding resetting the devices, so when the threat actor gained access to the infrastructure, they didn't need to do anything to collect CCNs, other than "yoink" the files. These days, *if* someone has a "security stack", actions will be taken during troubleshooting, some functionality will be enabled or disabled. AV may be disabled, host isolation may be disabled...and when the end is reached, those functionalities are not re-enabled/disabled. Something else we see a lot of is orgs doing a "test" rollout of EDR or some other tech, only to not move to a complete rollout, so that significant portions of the infrastructure are left unmonitored.

90

12 Comments

Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers

17

2 Comments

Cyber Attack Impacting Oregon Environmental Department The Oregon Department of Environmental Quality has reported a cyber attack that is affecting communications and operations including vehicle inspections. Some services will be shuttered through the weekend. #Oregon #cyber #cybersecurity #cyberattack #government https://lnkd.in/exc6as2w

14

3 Comments

New - Investigating Hy-Vee’s massive data breach, Hudson Rock identified critical employees infected by infostealers, compromising Atlassian (Confluence and Jira) credentials. This likely enabled this Stormous group 53GB data heist. (tl;dr below) New Blog (4 minutes read) - https://lnkd.in/dPZYU_-f TL;DR: On June 23, 2025, Stormous breached Hy-Vee’s Atlassian accounts, stealing 53GB of sensitive data, including infrastructure diagrams and operational details. Hudson Rock’s research uncovered an infostealer infections Hy-Vee employee devices, exposing credentials that likely granted attackers access, fueling one of 2025’s boldest retail breaches.

37

What the DFIR analyst does during an IR engagement (not only equal to a firefighter or detective) is not the same as what the management should do in handling an incident or what the GRC should do in managing an incident. Why do some experts write a playbook to combine every aspect of DFIR for the technical team to follow? Why does the procurement write a tender to ask a service provider certified with CISM/CISSP or equipped with digital forensic tools to do the IR tasks like this?

69

I haven't seen any announcement about this, but the PCI Security Standards Council has published an update in the last few days to the "Guidance for PCI DSS Requirements 6.4.3 and 11.6.1" Information Supplement. In the original version, it said "Note that PCI DSS Requirements 6.4.3 and 11.6.1 do not apply to merchants with webpages that redirect to a TPSP’s page (for example, via an HTTP 30x redirect, a meta redirect tag, or a JavaScript redirect)." That's been removed, and in its place it now says "Note that, where scripts are used as part of a redirection mechanism, PCI DSS Requirements 6.4.3 and 11.6.1 will apply to those scripts." The thing is, by fully-redirecting to a PCI DSS-compliant payment service provider or processor to take payments, the merchant doesn't have a payment page - and it's only the payment page (or parent page when iframes are used) that these requirements apply to. While I think protecting all JavaScript on a website is a really good security best practice - whether that's using CSP+SRI, Jscrambler's Webpage Integrity product, or something else, I'm currently scratching my head as to how this change to the guidance - which "does not replace or supersede requirements in any PCI SSC Standard" - currently applies. I'm curious to hear what others think...

54

17 Comments

𝗛𝗼𝘄 𝗺𝘂𝗰𝗵 𝗱𝗼 𝗣𝗖𝗜 𝗗𝗦𝗦 𝗮𝘀𝘀𝗲𝘀𝘀𝗺𝗲𝗻𝘁𝘀 𝗰𝗼𝘀𝘁? For my next post highlighting sponsors of the PCI AP and EU Community Meetings (CM), I am featuring SecurityMetrics.  https://lnkd.in/gXvJnNm5 Thank you to the SecurityMetrics team for being the Diamond and 2nd highest sponsor at the PCI North American Community Meeting (NACM) sponsoring the PCI SSC Café, and the Bronze sponsor sponsoring the lanyard at the PCI Europe Community Meeting (EUCM). I get this question very regularly and the answer from PCI is… I am afraid that I can’t help you. This is because PCI Council is a standards setting organization and we do not manage the compliance of our own standards and we do not conduct any security assessments.  Even questions like whether you should do an onsite assessment to obtain a PCI Report on Compliance (RoC) or a Self-Assessment Question (SAQ) is beyond the scope of PCI Council. So if you must adopt PCI standards like PCI DSS (Data Security Standards), you should first consult your Compliance Accepting Entity (CAE), this is likely your acquirer or client. It could be the Payment Brand too.  If they inform you that you are a Level 1 Merchant or Service Provider, and you need to submit the PCI RoC by a given date, the next questions will probably be “what do I do now?” and “how much will it cost?” PCI Qualified Security Assessors (QSA) can guide you through the process and provide a quote for their services. QSAs are cybersecurity experts trained and licensed by PCI Council to conduct PCI DSS security assessments. For example, SecurityMetrics is a PCI QSA. For the full list of QSAs, please refer to this list on the PCI website. Filter Place of Business to your country/market and confirm that the Region covers your country/market. https://lnkd.in/gpH8V7Cp QSAs may focus on different regions, they may provide other related services, and pricing may vary. Gary Glover, the VP of Assessments at SecurityMetrics has provided an article to describe the various considerations when pricing a security assessment as well as a nice list of questions that you should pose to your PCI QSA about pricing. https://lnkd.in/grHTqMYx Thank you Gary for the article, and thank you and Brad Caldwell for being part of the PCI GEAR (Global Executive Assessor Roundtable). I also noticed a nice article by Heff (Matt Heffelfinger) on why it is difficult to get accurate PCI compliance costs upfront and how much will PCI compliance software cost… https://lnkd.in/gV5vkKYY Disclaimer: PCI Council is a neutral body and my personal post is not an endorsement of any organization or solution. PCI Security Standards Council #pcissc #pcicommunity #pcidss #pcidssv4 #datasecurity #cybersecurity #payments #paymentsecurity Video credit: Thank you Canva for your platform and the royalty-free video.

23

RMF is shifting FAST. Checklist ISSOs won’t survive what’s coming. I had a conversation with an SCA-R who reviews ATO packages every single day and he told me something most people in this field don’t want to accept: “You can’t be a checklist person anymore. The industry is moving too fast.” A lot of people rely on templates. A lot of people memorize 800-53. A lot of people copy what someone else did last year. But that version of RMF is disappearing. The future belongs to the people who actually understand what’s happening under the hood, not the people who just upload documents. That means understanding: how systems are architected what the cloud actually inherits how software behaves how to match real technical evidence to controls how to identify true mission risk, not paperwork risk The people who learn this now will dominate the next decade. The people who don’t will be replaced by someone who understands both RMF and technology. This is the moment to upskill. The field is evolving. Don’t get left behind. #RMF #Cybersecurity #InformationSecurity

69

You might be feeling frustrated by the endless struggle of getting Sigma detection rules to work seamlessly in your open-source SIEM stack. It probably feels like every new rule demands manual conversions, special configs, and a ton of guesswork. It can be exhausting--and I’ve definitely been there. In this walkthrough I introduce how we can incorporate Velociraptor DFIR to solve our Sigma challenge. I share how I set up automated scans, tackled noisy detections, and fed alerts into my incident-response workflow (CoPilot). https://lnkd.in/gX5-X_mN

90

3 Comments