Companies Report Progress in Implementing CISA Secure by Design Pledge Goals; FBI: Warns of Compromised Government eMails Used to Request Information; Phishing Campaign Accuses Recipients of Copyright Infringement

There are seven goals here, and the signatories are often touting success focused on one or two of them, or nominal progress across all seven. With CISA threatening to increase the number of goals, it's going to be tricky making sure that all are fully met, not just progress made. When assessing a provider's progress against secure by design, make sure you look at the whole picture with your own measure of acceptable progress/residual risk.

Lee Neely

Oh good, nothing makes me feel more secure than more vendors giving a pinkie promise to do better at security. We need stronger regulation to enforce responsibility, accountability, and liability on vendors for the security flaws in their products.

Brian Honan

The public sector is as much of a target as the private sector, and both have employees under stress who click the wrong link. Beyond the basics of MFA and technical controls to block malicious sites and attachments, make sure you have required procedures in place for common BEC scenarios, which can help break the momentum and hopefully prevent the planned compromise.

Lee Neely

The email accounts are used to impersonate the legal department of the supposed copyright complainants and contain a password-protected Zip file. While the AI here is more in the form of machine learning and OCR, it's still prone to errors, notably language errors, so our traditional mitigations help, for now. It'd be a good idea to brief your legal team to be on the lookout for these as users are likely to forward to them for proper handling and response. Then check your (EDR, email, etc.) protections for new features which raise the bar, AI based or otherwise, which you may not have noticed.

Lee Neely

This is going to be an LLM with very specific training, and IL6 environment is very restricted, only operated by a CSP under contract to DoD or other federal agency in a DoD private community or Federal government community cloud. They are configured to both NIST SP 800-53 and CNSS 1253 requirements and can only operate at the NSS CIA Moderate-Moderate-Low level. This is a visible step along the EO 14028 directive which includes increased cloud adoption, and the order was extended to classified systems by National Security Memorandum (NSM) 8, 1/19/22.

Lee Neely

Not surprising given the large amount of money available within the defense budget and the need for companies to book revenue to justify capital investments in AI. It also helps Anthropic not having to endure the cost of FedRAMP certification. Expect to see more of this sort of partnership.

Curtis Dukes

Given the state the world is currently in, "You should seek a diplomatic solution," seems like a reasonable option to me.

Brian Honan

Licensing and standing up your own LLM, trained on a data set you're managing, provides a safe way to dive into that world without worry about your data being used to enhance another customer's prompt responses. Even so, you're still bound by any restrictions in the LLM's license, such as the prohibition on using the technology to harm people, destroy property, or develop weapons.

Lee Neely

Thompson Coburn is sending breach notices to folks who they have an address for; otherwise, the message on the TC Notification website covers anyone they missed or don't have addresses for, a nice move which indicates they have good information on where their sensitive data is as well as sufficient information for a forensic analysis. As they haven't determined there is any use of the data, they are providing guidance rather than credit restoration. The PHI came from New Mexico's PHS. If you're a customer, make sure that you're covered for ID theft/credit monitoring & restoration. Consider how well you know where your sensitive data is and what you could do to not only verify it's secured, but also to aid a forensic investigation if needed.

Lee Neely

A timely reminder to ensure that any third party suppliers you deal with have appropriate security controls in place to protect the data you entrust to them. Remember you can outsource the process but not the responsibility for that process.

Brian Honan

Law firms are increasingly becoming targets for miscreants, as they often don't have adequate cybersecurity controls in place. Every organization should implement an essential set of security controls. A good place to start is the CIS Critical Security Controls, Implementation Group 1.

Curtis Dukes

Input sanitization and patching aren't new ideas, and the Mazda system assessed does have a history of security updates. Even so, these systems need to be categorized as OT systems with long service lives, so while you could move newer versions to more secure coding practices, you'll still have old systems to maintain, which makes for a challenging support decision, particularly if you move to new languages. Short term, there appears to be an opportunity for researchers to partner with manufacturers to help identify weaknesses they are unable to uncover.

Lee Neely

This is not unlike DoD requiring NIST 800-171 for contractors protecting their data. The rules include annual cybersecurity evaluations, independent (non-biased) assessment plans that identify unaddressed vulnerabilities, a cybersecurity implementation plan which includes systems and how they are protected, detection measures, and incident response plans. The trick is using a risk-based approach to scale the requirements for relevance, as well as securing funding for implementation and oversight.

Lee Neely

The proposal is simply an extension of a trend by the executive branch to require an annual risk assessment and reporting on cybersecurity incidents. Likely those affected by the proposed rulemaking already complete an annual risk assessment. What may be problematic for the operators is meeting CISA secure by design principles via third-party software providers, when it is voluntary for those vendors.

Curtis Dukes

Third-party security remains a challenge, as they can and will make decisions around solutions, as well as mitigation of vulnerabilities, without your involvement. Make sure you have contract language that not only requires your controls to flow down valid and current security contacts, but also includes provisions for the validated removal of your data. Make sure these terms are validated regularly. Find out when the security of third-party service providers is assessed and who accepts the risk. Make sure it is sufficiently formalized and at an appropriate level; often risk acceptance involves someone out of the C-suite.

Lee Neely

The August attack, based on the IOCs, was most likely the work of the RansomHub gang. As neither RansomHub nor any other gang has taken credit for the attack, it's likely that Halliburton paid the ransom. The attack, in combination with the storms in the Gulf of Mexico, has cost Halliburton $.02/share in adjusted earnings. As most of us aren't able to absorb a $35 million loss, make sure you've got your ransomware playbook dialed in, remembering not only to verify your position on payment but also where you stand related to any OFAC issues which correspond with making such a payment, if you choose to do so.

Lee Neely

While the Q3 costs seem high to most folks, Halliburton's revenue in 2023 was 23B. So, it's unlikely that it will have a material effect on the company. It's also likely that Halliburton paid a ransom given that no gang has taken credit, and no data has been leaked. Bottom line, ransomware gangs will continue to attack if they get paid.

Curtis Dukes