Charlie Winckless

Vulnerability Assessments CIP-010-r3 Requires paper or active vulnerability assessment 95% doing paper assessments because of fragility of control system networks Introducing a network based Digital Twin as a way to do vulnerability scanning Including an AI reasoning agent as an adversary simulation Purely offline. -Brian Proctor Frenos Brian Proctor EnergySec

55

2024 set in motion major changes for certificate lifespans and DCV. In this Root Causes Podcast lookback episode Jason Soroko and I discuss the Apple 47-day proposal, stepping down certificate term, public versus private CA use cases, DCV reuse periods, MPIC, WHOIS, and other topics. Audio: https://lnkd.in/gH3Z-adY Video: https://lnkd.in/gN_VpVPy #pki #security

29

It seems like every quarter is a solid quarter for Fortinet...but can they keep it going? They're facing tricky near-term challenges like tariffs while trying to grow at scale, diversify revenue streams, and seed long-term growth. Decent problems to have, no doubt (except for the tariff part). A few highlights from Fortinet's Q1'25 report: → They're not worried about tariffs...yet Analysts on the call asked tariff-related questions every which way — as they should given the size of Fortinet's hardware business and manufacturing outside the United States. Fortinet's leadership team didn't blink. They had an answer for everything. The short version is: no sales cycle impacts yet, no meaningful change (positive or negative) on to the anticipated hardware refresh cycle, no plans to raise prices if tariffs hit, and flexibility to relocate manufacturing if needed. Fortinet is in a tough spot if tariffs happen, but it's not going to ruin the business. They'll have a plan. Probably layers of plans. → Lower than expected contributions from acquisitions They mentioned minimal revenue impact from acquisitions, partly due to higher than expected churn. They were bullish on Next DLP, which they acquired late last year. Linksys is part of the equation, too. Ken Xie called it a long-term play and said it will take time to work their magic on the hardware side. By process of elimination, I'm just going to assume the problem was Lacework (they didn't say) — but I'm just guessing, so don't make any serious investment decisions here. Immaterial contributions and high churn has to be a disappointing result so far, but they knew what they were getting into when buying a distressed asset. → Both SASE and SecOps are doing well, though Tariffs or not, Fortinet needs revenue diversity. Their SASE and SecOps businesses are the centerpieces of the strategy. This quarter was a positive signal, with Unified SASE ARR up 26% and 30% YoY respectively. Combined ARR is now $1.6 billion, which is bigger than most of cybersecurity's public companies. Fortinet's playbook for large, boring enterprises (like financial services and healthcare) just crushes it. Buy hardware firewalls. Add SD-WAN. Upgrade to SASE. Repeat, repeat, repeat. Case in point: they're excited about Sovereign SASE, of all things — the fully self-hosted version that only massive enterprises want. Literally the opposite of Cloudflare's strategy...but it works. --- The macro environment and geopolitical tensions are disproportionately bad for companies like Fortinet, but their leadership team has been through economic cycles before. Their methodical consistency is going to get challenged here, but they'll find a way to get through it.

63

9 Comments

🚨 Contractors are under pressure to meet CMMC 2.0 requirements—but the top performers are already ahead of the game. What do they have in common? ✅ Smart planning ✅ Strong partnerships ✅ A proactive security-first mindset The new Coalfire and Kiteworks State of CMMC 2.0 Readiness Report reveals what’s working (and what’s not) based on insights from 209 real contractors. Don’t get left behind. Read the full report now! ⤵️ https://ow.ly/EkYo50VLqU3 #CMMC2 #CyberRisk #ComplianceMatters #CyberReadiness

25

2 Comments

The Days of Cybersecurity "Box Checking" Are Over.... CMMC is no longer optional. A new Pentagon directive from Secretary Pete Hegseth made it crystal clear that cybersecurity is now the price of admission to the $320B defense market. He named United States Department of Defense CIO and CMMC architect Katie Arrington to help lead the charge. The message is loud and clear. The Department of Defense submitted the final CMMC rule for review on July 22. Once it is published, CMMC requirements will begin showing up in new contracts quickly. Most new defense contracts will include CMMC by October 1, 2025. By October 31, 2026, if you are not certified, you will not be eligible to win new work. This is the biggest change in federal contracting in years. It impacts primes, subs, and every company in the Defense Industrial Base. I break it all down in my latest Forbes column. What is changing. Why it matters. How to prepare now. 📖 Read it here: https://lnkd.in/giST7utQ 🔁 Please repost and follow my column for updates #CMMC #Cybersecurity #DefenseContracting #FederalAcquisition #GovCon #NIST800171 #Compliance #NationalSecurity #Leadership #Forbes

33

6 Comments

🚨 𝗧𝗼𝗽 𝟭𝟬 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗜𝗻𝗰𝗶𝗱𝗲𝗻𝘁𝘀 that Cyber Security News ® have reported Yesterday! 🚨 Cyber threats continue to evolve, targeting vulnerabilities across various systems. Here's a roundup of the most critical incidents reported yesterday by Cybersecurity News: 𝟭. 𝗖𝗜𝗦𝗔 𝗔𝗱𝗱𝘀 𝗜𝘃𝗮𝗻𝘁𝗶 𝗘𝗻𝗱𝗽𝗼𝗶𝗻𝘁 𝗠𝗮𝗻𝗮𝗴𝗲𝗿 𝗕𝘂𝗴𝘀 𝘁𝗼 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗲𝗱 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗖𝗮𝘁𝗮𝗹𝗼𝗴 Three critical vulnerabilities in Ivanti Endpoint Manager have been added to CISA’s Known Exploited Vulnerabilities catalog due to active exploitation. 𝟮. 𝗩𝗲𝗿𝗮𝗖𝗼𝗿𝗲 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗔𝗰𝘁𝗶𝘃𝗲𝗹𝘆 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗲𝗱 𝗯𝘆 𝗧𝗵𝗿𝗲𝗮𝘁 𝗔𝗰𝘁𝗼𝗿𝘀 Two vulnerabilities in VeraCore software are being actively exploited by the XE group, posing risks to supply chains. 𝟯. 𝗡𝗼𝗿𝘁𝗵 𝗞𝗼𝗿𝗲𝗮𝗻 𝗛𝗮𝗰𝗸𝗲𝗿𝘀 𝗪𝗲𝗮𝗽𝗼𝗻𝗶𝘇𝗲 𝗭𝗜𝗣 𝗙𝗶𝗹𝗲𝘀 𝗳𝗼𝗿 𝗠𝗮𝗹𝗶𝗰𝗶𝗼𝘂𝘀 𝗣𝗼𝘄𝗲𝗿𝗦𝗵𝗲𝗹𝗹 𝗘𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻 APT37, a North Korean hacking group, is leveraging ZIP files to execute malicious PowerShell scripts in targeted attacks. 𝟰. 𝗟𝗮𝗿𝗮𝘃𝗲𝗹 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗘𝗻𝗮𝗯𝗹𝗲𝘀 𝗔𝗿𝗯𝗶𝘁𝗿𝗮𝗿𝘆 𝗝𝗮𝘃𝗮𝗦𝗰𝗿𝗶𝗽𝘁 𝗘𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻 A critical flaw (CVE-2024-13918) in the Laravel framework allows attackers to execute malicious JavaScript code on websites using affected versions. 𝟱. 𝗠𝗼𝘅𝗮 𝗜𝗻𝗱𝘂𝘀𝘁𝗿𝗶𝗮𝗹 𝗘𝘁𝗵𝗲𝗿𝗻𝗲𝘁 𝗦𝘄𝗶𝘁𝗰𝗵𝗲𝘀 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗘𝘅𝗽𝗼𝘀𝗲𝘀 𝗔𝗱𝗺𝗶𝗻 𝗔𝗰𝗰𝗲𝘀𝘀 A flaw in Moxa’s PT series switches enables attackers to bypass authentication and gain administrative access. 𝟲. 𝗙𝗮𝗸𝗲 𝗕𝗶𝗮𝗻𝗟𝗶𝗮𝗻 𝗥𝗮𝗻𝘀𝗼𝗺 𝗖𝗹𝗮𝗶𝗺𝘀 𝗗𝗲𝗹𝗶𝘃𝗲𝗿𝗲𝗱 𝘃𝗶𝗮 𝗣𝗵𝘆𝘀𝗶𝗰𝗮𝗹 𝗟𝗲𝘁𝘁𝗲𝗿𝘀 US organizations have reported receiving fraudulent physical letters claiming to be from the BianLian ransomware group. 𝟳. 𝗠𝗲𝗱𝘂𝘀𝗮 𝗥𝗮𝗻𝘀𝗼𝗺𝘄𝗮𝗿𝗲 𝗔𝘁𝘁𝗮𝗰𝗸𝘀 𝗦𝘂𝗿𝗴𝗲 𝗯𝘆 𝟰𝟮% 𝘄𝗶𝘁𝗵 𝗡𝗲𝘄 𝗧𝗲𝗰𝗵𝗻𝗶𝗾𝘂𝗲𝘀 Medusa ransomware has seen a sharp increase in activity, employing advanced tools and double extortion methods. 𝟴. 𝗦𝘁𝗿𝗲𝗹𝗮 𝗦𝘁𝗲𝗮𝗹𝗲𝗿 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 𝗧𝗮𝗿𝗴𝗲𝘁𝘀 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗢𝘂𝘁𝗹𝗼𝗼𝗸 𝗨𝘀𝗲𝗿𝘀 The Strela Stealer malware campaign is actively harvesting login credentials from Microsoft Outlook users worldwide. 𝟵. 𝗣𝘆𝗣𝗜 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 𝗧𝗮𝗿𝗴𝗲𝘁𝘀 𝗘𝘁𝗵𝗲𝗿𝗲𝘂𝗺 𝗪𝗮𝗹𝗹𝗲𝘁𝘀 𝘃𝗶𝗮 𝗗𝗲𝘃𝗲𝗹𝗼𝗽𝗲𝗿𝘀 A malicious PyPI package named 'set-utils' has been discovered stealing Ethereum private keys from developers. 𝟭𝟬. 𝗠𝗼𝗼𝗻𝘀𝘁𝗼𝗻𝗲 𝗦𝗹𝗲𝗲𝘁 𝗗𝗲𝗽𝗹𝗼𝘆𝘀 𝗖𝘂𝘀𝘁𝗼𝗺 𝗥𝗮𝗻𝘀𝗼𝗺𝘄𝗮𝗿𝗲 𝗨𝘀𝗶𝗻𝗴 𝗖𝗿𝗲𝗮𝘁𝗶𝘃𝗲 𝗧𝗮𝗰𝘁𝗶𝗰𝘀 North Korean threat actor Moonstone Sleet is deploying advanced custom ransomware in targeted operations globally. 🔒 Stay informed and protect your systems! Read More Articles: www.cybersecuritynews.com & www.gbhackers.com #CyberSecurity #ThreatIntel #Ransomware #Vulnerabilities

411

11 Comments

Upcoming enhancements in Action1: We heard your feedback on role-based access control (RBAC). Until now, the “Manage Roles” permission did two jobs: managing roles and assigning users. Not super flexible. So we fixed it. 🎉 Now you’ll see two separate permissions: - Manage Roles – create and edit roles - Assign Roles – assign users to roles This gives you more granular control to delegate responsibly without over-provisioning. Less risk, more peace of mind. Heads up: If you already use “Manage Roles,” don’t forget to review your settings and add “Assign Roles” where needed. What do you think — is this going to help your team? What other enhancements would you like to see in RBAC? #Action1 #RBAC #PatchManagement

40

1 Comment

AWS US-East-1 Region Outage: Is the compliance juice worth the engineering squeeze? For all my Governance, Risk, and Compliance/Auditor peers who are asking their organizations to go multi-region or multi-cloud because it's a compliance best practice, please be mindful of the costs and the level of engineering effort this entails. Is the compliance juice actually worth the engineering squeeze? As examples, instead of defaulting to “go multi-region”, ask yourself: What’s our actual SLA? Does it encompass both failures from our providers, AND failures from our own bad code? What’s our tolerance for downtime, and how much does it cost us both in customer trust, AND dollars? What would going multi-region / multi-cloud have cost us in time and engineering effort over the last few years? My request - Use this incident as an opportunity to align yourself with your engineering organization, and build alliances by suggesting practical mitigation strategies, instead of berating others "because compliance said so." (h/t Arjay McCandless)

18

2 Comments