Dr. Ulrich Lang, CEO

Jason Soroko and I explain the major news items from the most recent CA/Browser Forum face-to-face meeting in Tokyo on the Root Causes Podcast. Topics include MPIC, 47-day certificate term, and Temporary Restraining Orders. Audio: https://lnkd.in/g-RaJifc Video: https://lnkd.in/gDJuyRAg

34

1 Comment

After DHS did not renew its funding contract for reasons unspecified, MITRE’s 25-year-old Common Vulnerabilities and Exposures (CVE) program was slated for an abrupt shutdown on April 16, which would have left security flaw tracking in limbo. CISA stepped in to provide a bridge. A CISA spokesperson sent CSO a statement saying, “The CVE Program is invaluable to cyber community and a priority of CISA. Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We appreciate our partners’ and stakeholders’ patience.” Sources say the contract extension will last 11 months. Yosry Barsoum, vice president and director of the Center for Securing the Homeland at MITRE, commented: “Thanks to actions taken by the government, a break in service for the Common Vulnerabilities and Exposures (CVE®) Program and the Common Weakness Enumeration (CWE™) Program has been avoided. As of Wednesday morning, April 16, 2025, CISA identified incremental funding to keep the Programs operational. We appreciate the overwhelming support for these programs that have been expressed by the global cyber community, industry, and government over the last 24 hours. The government continues to make considerable efforts to support MITRE’s role in the program and MITRE remains committed to CVE and CWE as global resources.” https://lnkd.in/gPhB8vVQ

170

12 Comments

MITRE ATT&CK v18 lands today with a groundbreaking update to ATT&CK's threat detection taxonomy. This restructuring—announced during ATT&CKcon by MITRE ATT&CK defense lead Lex Crumpton—will help cybersecurity teams better connect the dots across adversary behaviors, enabling more effective and informed defenses. Read more on Inside Cybersecurity: http://spklr.io/6047BzpN3 #ATTACKcon #Cybersecurity #ThreatInformedDefense #MITREattack

328

6 Comments

Self-Healing IAM Systems - A Business Centric Framework 🚀"The Identity Navigator" Podcast - New Episode Alert🚀   A self-healing IAM system enhances enterprise security by automating identity governance, mitigating operational risks, and ensuring adaptive security resilience.  By leveraging this framework organizations can create dynamic, self-correcting identity frameworks that reduce administrative overhead and improve security posture. Self-healing mechanisms ensure robust access management by automatically detecting and mitigating disruptions, policy misconfigurations, or security anomalies.   https://lnkd.in/ecm7Bz8V   Tune in now and let's check them out together 🎧🔍   #TheIdentityNavigator #IAM #Podcast #TechTalk #IdentityAndAccessManagement #IAM

36

2 Comments

Is Cyber Risk on the Rise? Next week, I'm doing a webcast for the RSA Conference to explore that question using 15 years of data on security incidents and losses. It draws from the upcoming 2025 Information Risk Insights Study (IRIS) from Cyentia Institute. Details and registration link below. Summary: Is cyber risk truly skyrocketing, as many believe? Are organizations more prone to breaches now than they were 10 years ago? Have the financial impacts of security incidents increased or decreased over time? Are these trends similar across organizations of all types and sizes? We’ll answer these questions together by analyzing a huge historical dataset of cyber events and losses. #cyberrisk #cyberresilience #cybersecurity March 26, 2025 | 10:00 AM PT | 1:00 PM ET Register: https://lnkd.in/ep3GKQ5w

46

6 Comments

The addition of the Govern function in NIST CSF 2.0 addresses the rise of risk management and governance as an essential task for IT and security teams. While it has existed in previous versions, this elevation to a core function places it in a position of necessary prominence for any organization looking to proactively assess, mitigate, and transfer their cyber risk through risk-driven cybersecurity strategies.

12

CISA has published a draft of the new CISA SBOM Minimum Elements! The 2021 NTIA Minimum Elements were an important step to help create a common specification of what should be in an SBOM. CISA is proposing an updated, clarified version that can be aligned with existing tools and support use cases. They are actively seeking feedback, so please share, review, and send them your thoughts! https://lnkd.in/eRm_zxT2

201

13 Comments

Recorded Future investigates how Russia’s intelligence services maintain controlled impunity over cybercriminal groups, identifying direct links, indirect affiliations, and tacit agreements that provide plausible deniability while supporting state objectives. Blog: https://lnkd.in/eAdzpAUZ PDF: https://lnkd.in/eFTDTvbB #RecordedFuture #cyber #threatintelligence #infosec #CTI #Russia #cybercrime #espionage #DarkCovenant

62

1 Comment

DFARS 7012 requires contractors to implement NIST SP 800-171 to protect Covered Defense Information (CDI). DFARS 7019/7020 requires contractors to perform a basic assurance self-assessment and submit a score to SPRS that is within 3 years of contract award. DFARS 7021 specifies the CMMC level required to be awarded a DoD contract. CMMC levels require either self-assessment or third-party assessment. When making the determination of the level required for a contract, there is a memo that outlines the process that must be followed by the DoD program manager to obtain a waiver to "CMMC assessment requirements" for that contract. "Program Managers and requiring activities should identify information security requirements for the types of information most likely to be associated with the planned contract effort. When market research indicates that including a CMMC assessment requirement may impede ability to generate robust competition or delay delivery of mission critical capabilities, the SAE, CAE, or DAE may approve requests to waive inclusion of CMMC assessment requirements. SAEs and CAEs must carefully weigh the risk of potential loss of CUI associated with mission critical capabilities before granting a waiver." Level 1 - "There are no circumstances likely to warrant approval of requests to waive CMMC Level 1 requirements." Level 2 - "In rare circumstances. such as when seeking competition from non-traditional DoD sources. waivers may be warranted for CMMC Level 2 third-party assessment requirements. Such waivers are not appropriate for contracts requiring performance by a cleared defense contractor. Approved waivers on a class basis must include a planned expiration date and guidance for requiring CMMC certification in subsequent solicitations." Level 3 - "In rare circumstances, waivers may be warranted for CMMC Level 3 third-party assessment requirements: such waivers, however, are not appropriate for contracts or work statements requiring access to both unclassified and classified DoD information." Full memo on the process found here, starting on page 6: https://lnkd.in/eeBCW53n #cmmc #dib #dfars

58

12 Comments

Navigating NIST 800-171 Compliance: A Guide for SMBs As cyber risks increase, it's crucial for Small and Medium-sized Businesses (SMBs) in the Defense Industrial Base (DIB) to protect sensitive information. Safeguarding Controlled Unclassified Information (CUI) is essential for their survival. Understanding NIST 800-171 and CMMC Compliance: NIST Special Publication 800-171 provides the framework for protecting this information, while the Cybersecurity Maturity Model Certification (CMMC) 2.0 builds upon it. For SMBs in the DIB, compliance isn't just a regulatory requirement—it's a strategic necessity for accessing Department of Defense (DoD) contracts and ensuring long-term business viability. Adhering to NIST SP 800-171 is a contractual obligation for organizations that handle CUI. https://lnkd.in/eshRftvJ

12

2 Comments