Howard Holton

Last week the White House released Version 2 of the National Cybersecurity Strategy Implementation Plan (NCSIP). The Plan, which outlines actions the federal government is taking to improve our national cybersecurity posture, includes five pillars, here's what MSPs should take away from this updated cybersecurity plan, and what specifically relates to their day-to-day practices and their SMB clients.

13

1 Comment

Beware of the pitfalls with XDR vendors—here’s what you need to watch out for: - XDR is not SIEM: Don't mistake XDR for a log management system. The more logs you shove into it, the worse it performs. XDR is designed for precision, not data hoarding. Manage it wisely, or you'll lose control. - SIEM isn’t XDR: Merely slapping “Nextgen” in front of your SIEM doesn’t transform it into XDR. SIEM is inherently limited by variety and high data volume—understand its boundaries before you push them. - Ignore the hype: Claims that cloud-based XDR offers better correlation are just marketing fluff. Data isolation is crucial, regardless of where it's stored. If your data isn't loaded into the cloud, it should not impact the quality of threat detection. Vendors can upload everything necessary for detection to your on-prem instance. Remember, the main difference between on-prem and cloud is cost and ease of implementation/use. Stay sharp and don’t let vendor slick talk cloud your judgment. #XDR #SIEM

100

9 Comments

What's the inside scoop on machine-readable control sets for GRC? A previous colleague of mine shared NIST's Open Security Controls Assessment Language (OSCAL) with me. In essence, it is a schema to represent & share control sets in a machine-readable format. As I am building emergence: a security graph for GRC, I'm wondering: Does anyone have experience with OSCAL or similar formats? How widely adopted is it? Should I support it, or keep the model simple?

22

12 Comments

CISA Alerts on Active Exploitation of Critical Vulnerabilities in GeoServer, Linux Kernel, and Roundcube The Cybersecurity and Infrastructure Security Agency (CISA) has sounded the alarm over active exploitation of vulnerabilities in popular software products including GeoServer, the Linux kernel, and Roundcube Webmail, underscoring the urgency for organizations to apply recommended patches. ➡ GeoServer under Threat A severe vulnerability within GeoServer, identified as CVE-2022-24816 and boasting a CVSS score of 9.8, poses a significant risk due to a code injection flaw found in the Jai-Ext open source project. 👁 Attackers could exploit this vulnerability to execute remote code. GeoServer addressed the issue in version 1.2.22, released in April 2022, by removing the capability to inject malicious code. Despite the availability of technical details and proof-of-concept (PoC) exploit code since August 2022, the flaw remains a target for threat actors. ➡Linux Kernel Vulnerability Another critical concern highlighted by CISA is a use-after-free issue within the Linux kernel, tracked as CVE-2022-2586 with a CVSS score of 7.8. This vulnerability has implications for privilege escalation through the manipulation of nft tables in a way that can lead to a use-after-free scenario. Patched in early August 2022 following its demonstration at Pwn2Own Vancouver in May 2022, technical details and PoC code were published shortly after, marking it a significant risk. ➡Roundcube Webmail XSS Issue An older, yet actively exploited vulnerability found in versions of Roundcube Webmail prior to 1.4.5 and 1.3.12, has also been flagged by CISA. Dubbed CVE-2020-13965 and rated with a CVSS score of 6.1, this cross-site scripting (XSS) vulnerability can be triggered through malicious XML attachments. Roundcube issued patches for this flaw in early June 2020, with PoC code following soon after. Although the vulnerability has been known for four years, the recent CISA warning underscores its ongoing threat. ✍ As part of its directive (BOD 22-01), CISA has mandated federal agencies to address these vulnerabilities by implementing the available mitigations or by removing the compromised products from their environments by July 17. CISA emphasizes the high risk these vulnerabilities pose to federal operations, urging immediate action to thwart potential cyberattacks. #cybersecurity #cyberattack #vulnerability #cisa #cyberrisk #cyberthreat https://lnkd.in/dpW-Thne

5