Saad Nasir

Looking for #free courses? NIST is offering three free courses on SP 800-53 - Security and Privacy Controls for Information Systems and Organizations. If your not familiar with 800-53, it is a publication from the NIST that provides a comprehensive set of security and privacy controls for federal information systems and organizations. These controls are designed to safeguard federal information and information systems from cybersecurity threats, ensuring the confidentiality, integrity, and availability of data. The publication is part of the broader NIST Special Publication 800-series that provides guidelines for computer security. Their throwing in the #RMF introductory course for good measure! The RMF Online Introductory Courses offers a primer on risk management, focusing on the NIST Risk Management Framework (RMF) and its approach to managing cybersecurity and privacy risks. These courses are accessible on-demand and are free of charge! #nist #productsecurity #applicationsecurity #risk #training

29

7 Comments

📱The National Security Agency (NSA) recommends 𝘁𝘂𝗿𝗻𝗶𝗻𝗴 𝘆𝗼𝘂𝗿 𝗱𝗲𝘃𝗶𝗰𝗲 𝗼𝗳𝗳 𝗮𝗻𝗱 𝗼𝗻 𝗲𝘃𝗲𝗿𝘆 𝘄𝗲𝗲𝗸 𝘁𝗼 𝗽𝗿𝗼𝘁𝗲𝗰𝘁 𝗮𝗴𝗮𝗶𝗻𝘀𝘁 𝘇𝗲𝗿𝗼-𝗰𝗹𝗶𝗰𝗸 𝗲𝘅𝗽𝗹𝗼𝗶𝘁𝘀. **However, this advice can only SOMETIMES prevent these attacks.** Here are some essential best practices to protect your personal and sensitive information when using your cell/mobile phone: 𝐃𝐢𝐬𝐚𝐛𝐥𝐞 𝐋𝐨𝐜𝐚𝐭𝐢𝐨𝐧 𝐒𝐞𝐫𝐯𝐢𝐜𝐞𝐬: 📍 Turn off location services when unnecessary and avoid bringing devices to sensitive locations. 𝐑𝐞𝐠𝐮𝐥𝐚𝐫 𝐃𝐞𝐯𝐢𝐜𝐞 𝐏𝐨𝐰𝐞𝐫 𝐂𝐲𝐜𝐥𝐢𝐧𝐠: 🔄 Power off and on your device weekly. 𝐀𝐯𝐨𝐢𝐝 𝐒𝐞𝐧𝐬𝐢𝐭𝐢𝐯𝐞 𝐂𝐨𝐧𝐯𝐞𝐫𝐬𝐚𝐭𝐢𝐨𝐧𝐬: 🤐 Do not have sensitive conversations on personal devices. Use SIGNAL if you want to do so. 𝐇𝐚𝐧𝐝𝐥𝐞 𝐄𝐦𝐚𝐢𝐥 𝐀𝐭𝐭𝐚𝐜𝐡𝐦𝐞𝐧𝐭𝐬 𝐚𝐧𝐝 𝐋𝐢𝐧𝐤𝐬 𝐂𝐚𝐮𝐭𝐢𝐨𝐮𝐬𝐥𝐲: 📧 Do not open unknown email attachments or links, even from legitimate senders. 𝐔𝐬𝐞 𝐓𝐫𝐮𝐬𝐭𝐞𝐝 𝐀𝐜𝐜𝐞𝐬𝐬𝐨𝐫𝐢𝐞𝐬: 🔌 Use original charging cords or trusted accessories and avoid public USB charging stations. 𝐔𝐩𝐝𝐚𝐭𝐞 𝐒𝐨𝐟𝐭𝐰𝐚𝐫𝐞 𝐚𝐧𝐝 𝐀𝐩𝐩𝐥𝐢𝐜𝐚𝐭𝐢𝐨𝐧𝐬: 🆕 Update device software and applications as soon as possible. 𝐒𝐭𝐫𝐨𝐧𝐠 𝐋𝐨𝐜𝐤-𝐒𝐜𝐫𝐞𝐞𝐧 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲: 🔒 Use strong PINs/passwords and set the device to lock automatically after 5 minutes or less. 𝐀𝐯𝐨𝐢𝐝 𝐉𝐚𝐢𝐥𝐛𝐫𝐞𝐚𝐤𝐢𝐧𝐠 𝐨𝐫 𝐑𝐨𝐨𝐭𝐢𝐧𝐠: 🚫 Do not jailbreak or root the device. 𝐃𝐢𝐬𝐚𝐛𝐥𝐞 𝐁𝐥𝐮𝐞𝐭𝐨𝐨𝐭𝐡 𝐖𝐡𝐞𝐧 𝐍𝐨𝐭 𝐢𝐧 𝐔𝐬𝐞: 🔵 Turn off Bluetooth when not using it, OR do not use it. Wired connections are best! 𝐀𝐯𝐨𝐢𝐝 𝐏𝐮𝐛𝐥𝐢𝐜 𝐖𝐢-𝐅𝐢: 📶 Do not connect to public Wi-Fi networks and disable Wi-Fi when unneeded. If you must connect to a public Wi-Fi network, you should at least have a trusted VPN service (Yes, VNPs can be compromised, but it is better than nothing). 𝐔𝐬𝐞 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐯𝐞 𝐀𝐜𝐜𝐞𝐬𝐬𝐨𝐫𝐢𝐞𝐬: 🛡️ Consider using a protective case that blocks the microphone and covers the camera. Faraday cases are great if you want to go dark and block signals. 💬 What mobile security tips do you follow to keep your data safe? Share your best practices and insights in the comments below! Cyber Security Forum Initiative #CSFI #CyberSecurity #MobileSecurity #DataProtection #BestPractices #TechTips 

237

19 Comments

Security Company Advertisement "Fact Checker": "Secure....Everything....You Build and Run in the Cloud" - Really EVERYTHING? "Currently, 55% of companies have at least one publicly exposed database" - When does "exposed" = not secure? Let's see ~33Million "companies" (just in the USA)...so there are over 18M "publicly exposed databases" ~333Million "companies" in the world...so there are over 183M "publicly exposed databases" Love to see them try and secure the supposed 183M databases. Please marketing people, vet this stuff with trained, certified, licensed security professionals, PLEASE.

4

Beware of the pitfalls with XDR vendors—here’s what you need to watch out for: - XDR is not SIEM: Don't mistake XDR for a log management system. The more logs you shove into it, the worse it performs. XDR is designed for precision, not data hoarding. Manage it wisely, or you'll lose control. - SIEM isn’t XDR: Merely slapping “Nextgen” in front of your SIEM doesn’t transform it into XDR. SIEM is inherently limited by variety and high data volume—understand its boundaries before you push them. - Ignore the hype: Claims that cloud-based XDR offers better correlation are just marketing fluff. Data isolation is crucial, regardless of where it's stored. If your data isn't loaded into the cloud, it should not impact the quality of threat detection. Vendors can upload everything necessary for detection to your on-prem instance. Remember, the main difference between on-prem and cloud is cost and ease of implementation/use. Stay sharp and don’t let vendor slick talk cloud your judgment. #XDR #SIEM

100

9 Comments

DoD is already in progress to update DFARS 252.204-7012 to align it with the CMMC audit program. How elegant would it be to simply put a single sentence into DFARS 7012 and the CMMC Final Rule that says : "For contracts with an award date prior to xx/xx/2026, the requirements within 800-171 rev 2 shall apply; after xx/xx/2026, the requirements within 800-171 rev 3 shall apply."

56

6 Comments