John C.

Security Company Advertisement "Fact Checker": "Secure....Everything....You Build and Run in the Cloud" - Really EVERYTHING? "Currently, 55% of companies have at least one publicly exposed database" - When does "exposed" = not secure? Let's see ~33Million "companies" (just in the USA)...so there are over 18M "publicly exposed databases" ~333Million "companies" in the world...so there are over 183M "publicly exposed databases" Love to see them try and secure the supposed 183M databases. Please marketing people, vet this stuff with trained, certified, licensed security professionals, PLEASE.

4

Ask the CCP: SCOPE AND BOUNDARIES-CLOUD & MSSP So, I am counting the days until (around) October 28th: • 56 is the approximate number of work days . . .   . . . that sometime in late October: CMMC version 2 will (might) become effective. THIS JUST IN - the CyberAB projected that the Effective-ness of CMMC version 2 might not occur until maybe March of 2025. I posted a 1-off in yesterday’s installment (T.A.R.D.I.S).  1. TO LEAD with Yesterday’s topic which is boundaries I will preface today’s discussion which is noted above with commentary about how to represent your boundaries. Historically there’s always been a balance in security diagrams that the IT staff seems to not always grasp. Meaning that I have seen some truly awful data flow diagrams and boundary diagrams as an assessor for the last couple of decades. And already out there we go So my prescription for all the OSC , is to get your CMMC certification boundary and assessment boundary well defined early. The certification boundary coincides with your list of CMMC assets against other types of assets. Likewise your CMMC assessment boundary shows what is going to be assessed there are demonstrative diagrams available as examples. As I am quite adept at creating these, DM me if you need assistance with creating Data Flow Diagrams as well as Boundary Diagrams and Assessment Diagrams. These are critical to get correct for your CMMC evaluation.  2. This installment goes deeper to addressing cloud tenants and Managed IT/Security Services (MSSP). It is stated in CMMC V2 rule that Cloud Service Providers (CSP) are not part of the CMMC boundary – only the Organization Seeking Certification (OSC) tenant is to be a CMMC Asset. However, MSSPs hosting IT and Security Assets for the OSC are within the CMMC Boundary and Scope. This based on no separation between the organizations, meaning that CMMC assumes the MSSP has insight to the OSC’s information.  Therefore MSSPs must be concurrently certified to the same as the OSC they are supporting. However, DoD is not yet permitting MSSPs to enter the CMMC Certification processes.  Advice to MSSPs is therefore, be prepared for complete CMMC compliance immediately.  #CMMCv2 #boundary #assessment #dfd I Prepare and Evaluate Organizational Readiness for CMMCv2. So if you have any questions. . . .  Since I am both CCP and Certified Instructor, I am a CUI expert Or at least I know where to find the specifications and details 🤔 Tap Me/DM here on LinkedIn or email

1

Reading, spelling and reading comprehension are integral to success in jobs requiring concise documentaion. Cybersecurity reports and documents may be used for future reference in security operation or criminal prosecution. #The more you know...!🤔

13

2 Comments

Looking for #free courses? NIST is offering three free courses on SP 800-53 - Security and Privacy Controls for Information Systems and Organizations. If your not familiar with 800-53, it is a publication from the NIST that provides a comprehensive set of security and privacy controls for federal information systems and organizations. These controls are designed to safeguard federal information and information systems from cybersecurity threats, ensuring the confidentiality, integrity, and availability of data. The publication is part of the broader NIST Special Publication 800-series that provides guidelines for computer security. Their throwing in the #RMF introductory course for good measure! The RMF Online Introductory Courses offers a primer on risk management, focusing on the NIST Risk Management Framework (RMF) and its approach to managing cybersecurity and privacy risks. These courses are accessible on-demand and are free of charge! #nist #productsecurity #applicationsecurity #risk #training

29

7 Comments

Today I learned that iOS can keep some files with the same name in the same directory as long as there is a difference in case. Be aware that Windows and default macOS file systems do not allow this when exporting files like these. Note: If you have 2 mobile sms plists in the same target directory the one with the retention value will be the one in use by the device. #DFIR #DigitalForensics #MobileForensics

154

17 Comments