GIT to Extend 2FA Requirement to Developers and Contributors; Apple, Microsoft, and Google Will Support FIDO Alliance Standards to Eliminate Passwords; White House Memorandum On Quantum Computing Details Timeline for US Crypto Upgrades

This is awesome. Comprehensive 2FA is essential to prevent bypass use cases. Be proactive and enable 2FA for your account now rather than scrambling, and getting stressed, after a hard deadline. Check out the npm 2FA phased rollout timeline to be aware of when you may fall into an enforcement window and to model a plan for getting your staff and contributors on 2FA.

Lee Neely

Github had previously said only developers and admins would have the 2FA requirement, good to see strong authentication mandate extended.

John Pescatore

This is by far the most promising effort to solve the authentication challenge. In my opinion, the most important part of this standard is that it will not require users to buy a new device, but instead they may use devices they already own and know how to use as authenticators. If you haven't done so yet: Look into what it will take to integrate these standards with your web application.

Johannes Ullrich

Great to see but most previous attempts at getting standards to be agreed upon and implemented by these “big three’ have failed. I think this has a much better chance of success. Fewer passwords in use are better than more, but important to see the protocols and implementations thoroughly pounded on by researchers before any releases.

John Pescatore

Adoption of new stronger authentication technology can be hastened by it being easier and faster than the old technology. The new standards from FIDO and W3C being implemented in Office, Azure, iPhones, Chrome, Gmail, and iCloud are intended to do just that, enabling access to existing passkeys, allowing mobile devices to be used for authentication on a nearby computer. It's time to see where these activities lie on your IDP or service provider's roadmap to build a path forward towards passwordless authentication for your users.

Lee Neely

The risks posed by a cryptanalytically relevant quantum computer would pose to all existing use of public key crypto have been long known and discussed. But, quantum has kinda been another Y2K-like risk, but without a deadline. Good to see a proactive, but reasonably timed, effort being put in place (public comment period to open in 90 days) to lead a new federal crypto standard by 2024. This memorandum also recognizes that US adversaries will focus on stealing quantum technology being developed in the US and mandates extra protections be implemented by all development organizations.

John Pescatore

Implementing new encryption algorithms will take years or even decades. This is why we need to worry about this now. The threat from quantum computing may never materialize, but it doesn't hurt to think ahead now.

Johannes Ullrich

The goal is to move to cryptographic agility, allowing for migration to encryption which is resistant to decryption by a cryptanalytically relevant quantum computer (CRQC) attack. Within one year of the memo, all agencies are expected to report on information systems which have not mitigated risks of CRQCs. The challenge will be availability of products which meet updated NIST cryptographic standards (FIPS 140) which agencies are required to implement along with maintaining backwards compatibility to support collaboration with others who have not implemented support for these new standards.

Lee Neely

Most of the deficiencies stemmed from lack of full implementation of continuous monitoring based on tools/platforms from the DHS Continuous Diagnostics and Mitigation (CDM) Program. HHS, like many, has a distributed responsibility model from HQ to operational divisions to contractors. This complicates asset inventory, configuration management and full monitoring/reporting but is the realistic model for most organizations. Takes more support from the top, and often some additional funding, to completely move the operating divisions away from legacy security controls that have already been paid for.

John Pescatore

As an agency, this is not what you want to hear from your IG. The audit was performed by E&Y on behalf of the HHS OIG. While the report (https://oig.hhs.gov/oas/reports/region18/182111200.pdf) notes improvements since the 2020 evaluation, they are not sufficient to meet the requirements, highlighting the need for stronger supply chain security controls, something we're all dealing with. Read through the management responses in the report; many areas of concerns are things we're all dealing with, identity management, identification and categorization of systems, configuration management, appropriate visibility into current state and making sure that security remains in place. Note the challenges identified in a federated environment and think about how that applies to your own autonomous or semi-autonomous business units or partners when meeting your cybersecurity and interoperation goals.

Lee Neely

If you are in healthcare or related medical services, this a good checklist to apply against your existing playbooks and processes.

John Pescatore

While this is intended as a tactical measure in response to collateral damage from current cyberwarfare activities, this is a good checklist beyond the healthcare industry. Note that this checklist [https://healthsectorcouncil.org/occi] is a collection of homework assignments, many of which you've already completed. Make sure that you've got validated copies in known locations which are accessible during an incident. If you're keeping physical copies in binders, make sure they are maintained on a regular, non-optional basis.

Lee Neely

This kind of guidance is preferable to that (such as HIPAA) which expects buyers and end users to do "risk assessments" which require knowledge and experience that most do not have. While efficient security must be risk based, the most significant risks are common to most organizations. We know what they are; we should not expect each organization to discover them de novo.

William Hugh Murray

Heroku notes that some customers may also receive notifications directly from Salesforce relating to actions required after the breach. The exfiltrated passwords are salted and hashed; even so, a forced rotation is a great idea. In addition to password rotations, integration with GitHub and the Heroku dashboard or automation remains disabled, the status updated from April 26th includes instructions for deploying their apps until the integration is restored.

Lee Neely

If your business model is based on anonymity, or not providing logs, this new law makes doing business in India a non-starter. As a user, use of a VPN to secure traffic where your network connection is untrusted remains a best practice. Keep an eye on guidance from your provider when planning use in foreign countries to avoid regulatory entanglements.

Lee Neely

The new framework is being piloted, and uses technology which isn't incorporated into the current HIPAA act. In parallel, a new Health Data Use and Privacy Commission Act is in committee. This new act is intended to update the HIPAA requirements allowing for better alignment with modern technology. The trick is to create a framework which provides guidance that is not technology-specific to support advancement and innovation.

Lee Neely

This will help you get your arms around beefing up your supply chain security efforts. Watch for an upcoming “quick start” guide to help start your processes. While some actions may require resources and funding, progress can be made with tweaks to existing processes and procedures you can implement today.

Lee Neely

“The primary audience for the revised publication is acquirers and end users of products, software and service.” Caveat Emptor. Buyers and end-users cannot solve this problem. The solution rests with suppliers, with their transparency and accountability. Start with a digital software bill of materials.

William Hugh Murray

This is an authentication bypass flaw with a 9.8 CVSS score. As your Big-IP is often an Internet-facing device, you're going to want to verify the plans to remediate or mitigate this vulnerability. The mitigations may be more complex than simply applying the update. Even so, make sure that you're limiting access to your iControl REST and other management interfaces for your F5 products. If you're on devices running versions prior to 13.x of BIG-IP, you need to update or replace them (The current version is 17.x) Note that BIG-IQ, F5OS-A/C and Traffix SDC devices are not affected.

Lee Neely