Matt Clark

I haven't seen any announcement about this, but the PCI Security Standards Council has published an update in the last few days to the "Guidance for PCI DSS Requirements 6.4.3 and 11.6.1" Information Supplement. In the original version, it said "Note that PCI DSS Requirements 6.4.3 and 11.6.1 do not apply to merchants with webpages that redirect to a TPSP’s page (for example, via an HTTP 30x redirect, a meta redirect tag, or a JavaScript redirect)." That's been removed, and in its place it now says "Note that, where scripts are used as part of a redirection mechanism, PCI DSS Requirements 6.4.3 and 11.6.1 will apply to those scripts." The thing is, by fully-redirecting to a PCI DSS-compliant payment service provider or processor to take payments, the merchant doesn't have a payment page - and it's only the payment page (or parent page when iframes are used) that these requirements apply to. While I think protecting all JavaScript on a website is a really good security best practice - whether that's using CSP+SRI, Jscrambler's Webpage Integrity product, or something else, I'm currently scratching my head as to how this change to the guidance - which "does not replace or supersede requirements in any PCI SSC Standard" - currently applies. I'm curious to hear what others think...

54

17 Comments

Self-Healing IAM Systems - A Business Centric Framework 🚀"The Identity Navigator" Podcast - New Episode Alert🚀   A self-healing IAM system enhances enterprise security by automating identity governance, mitigating operational risks, and ensuring adaptive security resilience.  By leveraging this framework organizations can create dynamic, self-correcting identity frameworks that reduce administrative overhead and improve security posture. Self-healing mechanisms ensure robust access management by automatically detecting and mitigating disruptions, policy misconfigurations, or security anomalies.   https://lnkd.in/ecm7Bz8V   Tune in now and let's check them out together 🎧🔍   #TheIdentityNavigator #IAM #Podcast #TechTalk #IdentityAndAccessManagement #IAM

36

2 Comments

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77

2024 set in motion major changes for certificate lifespans and DCV. In this Root Causes Podcast lookback episode Jason Soroko and I discuss the Apple 47-day proposal, stepping down certificate term, public versus private CA use cases, DCV reuse periods, MPIC, WHOIS, and other topics. Audio: https://lnkd.in/gH3Z-adY Video: https://lnkd.in/gN_VpVPy #pki #security

29

🎙️ Big News: 'Simply ICS Cyber' is About to Drop! 🚀 Ever wondered what keeps industrial control systems running securely in our increasingly connected world? Get ready for the inside scoop from the trenches of OT/ICS cybersecurity! 🚨Thrilled to announce the launch of "Simply ICS Cyber" - hosted by Good times and EXPERTS Don C. Weber and Thomas VanNorman, CISSP, GICSP ----------------------- Get a fresh take on industrial cybersecurity featuring two battle-tested ICS security veterans who've seen it all. From power plants to manufacturing floors, we're pulling back the curtain on what it really takes to protect critical infrastructure. ----------------------- 🎬 Premiere Episode: February 19, 2025 at 9:30 AM EST 📍 Where: Simply Cyber YouTube Channel https://lnkd.in/e9FS-3B5 ----------------------- Want a sneak peek? Check out our teaser video that just dropped! 👇 Don't miss this if you're: 👀 An ICS/OT security professional 👀 Working in critical infrastructure 👀 Interested in industrial cybersecurity 👀 Looking to bridge the IT/OT security gap Trust me, you won't want to miss what our experts have to share! ----------------------- Repost ♻️for your network and hook'm up! Follow 👉🏼 Gerald Auger, Ph.D. for more content like this ----------------------- #ICSSecurity #CyberSecurity #OTSecurity #IndustrialCybersecurity #SCADA #CriticalInfrastructure #SimplyICSCyber 

55

4 Comments

Vulnerability Assessments CIP-010-r3 Requires paper or active vulnerability assessment 95% doing paper assessments because of fragility of control system networks Introducing a network based Digital Twin as a way to do vulnerability scanning Including an AI reasoning agent as an adversary simulation Purely offline. -Brian Proctor Frenos Brian Proctor EnergySec

55

New lab drop from Pwned Labs! Defensive infrastructure such as SIEMs can catch threat actors, but without proper controls and in the wrong hands they can provide an entry point, lateral movement and increase our access in on-premises and cloud environments. Get your red team on and learn how to leverage defensive infrastructure to achieve objectives in this intermediate lab. Get hands on with creating a malicious add-in, take control of the underlying OS and increase AWS access! Lab link in the comments 👇

148

4 Comments

It seems like every quarter is a solid quarter for Fortinet...but can they keep it going? They're facing tricky near-term challenges like tariffs while trying to grow at scale, diversify revenue streams, and seed long-term growth. Decent problems to have, no doubt (except for the tariff part). A few highlights from Fortinet's Q1'25 report: → They're not worried about tariffs...yet Analysts on the call asked tariff-related questions every which way — as they should given the size of Fortinet's hardware business and manufacturing outside the United States. Fortinet's leadership team didn't blink. They had an answer for everything. The short version is: no sales cycle impacts yet, no meaningful change (positive or negative) on to the anticipated hardware refresh cycle, no plans to raise prices if tariffs hit, and flexibility to relocate manufacturing if needed. Fortinet is in a tough spot if tariffs happen, but it's not going to ruin the business. They'll have a plan. Probably layers of plans. → Lower than expected contributions from acquisitions They mentioned minimal revenue impact from acquisitions, partly due to higher than expected churn. They were bullish on Next DLP, which they acquired late last year. Linksys is part of the equation, too. Ken Xie called it a long-term play and said it will take time to work their magic on the hardware side. By process of elimination, I'm just going to assume the problem was Lacework (they didn't say) — but I'm just guessing, so don't make any serious investment decisions here. Immaterial contributions and high churn has to be a disappointing result so far, but they knew what they were getting into when buying a distressed asset. → Both SASE and SecOps are doing well, though Tariffs or not, Fortinet needs revenue diversity. Their SASE and SecOps businesses are the centerpieces of the strategy. This quarter was a positive signal, with Unified SASE ARR up 26% and 30% YoY respectively. Combined ARR is now $1.6 billion, which is bigger than most of cybersecurity's public companies. Fortinet's playbook for large, boring enterprises (like financial services and healthcare) just crushes it. Buy hardware firewalls. Add SD-WAN. Upgrade to SASE. Repeat, repeat, repeat. Case in point: they're excited about Sovereign SASE, of all things — the fully self-hosted version that only massive enterprises want. Literally the opposite of Cloudflare's strategy...but it works. --- The macro environment and geopolitical tensions are disproportionately bad for companies like Fortinet, but their leadership team has been through economic cycles before. Their methodical consistency is going to get challenged here, but they'll find a way to get through it.

63

9 Comments

🚨 Contractors are under pressure to meet CMMC 2.0 requirements—but the top performers are already ahead of the game. What do they have in common? ✅ Smart planning ✅ Strong partnerships ✅ A proactive security-first mindset The new Coalfire and Kiteworks State of CMMC 2.0 Readiness Report reveals what’s working (and what’s not) based on insights from 209 real contractors. Don’t get left behind. Read the full report now! ⤵️ https://ow.ly/EkYo50VLqU3 #CMMC2 #CyberRisk #ComplianceMatters #CyberReadiness

25

2 Comments

K-12 Cybersecurity Insider | 8/25/2025 In this edition: * When SSO and MFA Aren't Enough: Hidden Credential Risk in K-12 * L.A. Schools Telehealth Vendor Waited 8 Months to Report Breach * If a 14-year-old could hack them, how weak was security for 400,000 confidential student records? * K12 SIX Announces 2025-26 Steering Committee Read more and sign up to get it delivered straight to your inbox: https://lnkd.in/enaKAHCb #edtech #edusec K12 SIX

26

1 Comment