Jeremy Trinka

I haven't seen any announcement about this, but the PCI Security Standards Council has published an update in the last few days to the "Guidance for PCI DSS Requirements 6.4.3 and 11.6.1" Information Supplement. In the original version, it said "Note that PCI DSS Requirements 6.4.3 and 11.6.1 do not apply to merchants with webpages that redirect to a TPSP’s page (for example, via an HTTP 30x redirect, a meta redirect tag, or a JavaScript redirect)." That's been removed, and in its place it now says "Note that, where scripts are used as part of a redirection mechanism, PCI DSS Requirements 6.4.3 and 11.6.1 will apply to those scripts." The thing is, by fully-redirecting to a PCI DSS-compliant payment service provider or processor to take payments, the merchant doesn't have a payment page - and it's only the payment page (or parent page when iframes are used) that these requirements apply to. While I think protecting all JavaScript on a website is a really good security best practice - whether that's using CSP+SRI, Jscrambler's Webpage Integrity product, or something else, I'm currently scratching my head as to how this change to the guidance - which "does not replace or supersede requirements in any PCI SSC Standard" - currently applies. I'm curious to hear what others think...

54

17 Comments

Autonomy in the SOC shouldn’t mean black-box automation. What it should mean? ✅ Transparent decisions ✅ Documented steps ✅ The ability to audit and override ✅ Learning that compounds Too many tools confuse “autonomy” with “hands off.” Security leaders can’t afford that. The next generation of platforms must offer more visibility, not less.

34

The backlog continues to grow, with "Undergoing Analysis" breaking 10k now. This total backlog is more vulns than total disclosures for most prior years. CVE getting last minute funding from CISA makes zero difference if there is no CPE, CVSS, etc. that assists teams in triage and programmatically addressing patches.

44

5 Comments

Self-Healing IAM Systems - A Business Centric Framework 🚀"The Identity Navigator" Podcast - New Episode Alert🚀   A self-healing IAM system enhances enterprise security by automating identity governance, mitigating operational risks, and ensuring adaptive security resilience.  By leveraging this framework organizations can create dynamic, self-correcting identity frameworks that reduce administrative overhead and improve security posture. Self-healing mechanisms ensure robust access management by automatically detecting and mitigating disruptions, policy misconfigurations, or security anomalies.   https://lnkd.in/ecm7Bz8V   Tune in now and let's check them out together 🎧🔍   #TheIdentityNavigator #IAM #Podcast #TechTalk #IdentityAndAccessManagement #IAM

36

2 Comments

After 20+ SIEM onboardings and migrations, here’s how I'd distill my approach into 3 short no bullshit steps: 1️⃣ Start with collecting security alerts from existing tools. 2️⃣ Figure out what you want to monitor*. Send data in, write detections. 3️⃣ Find 1-3 important systems and monitor them. Repeat step 2️⃣ until you run out of money. *my approach in comments

88

16 Comments

Interlock Ransomware: Critical Enterprise Threat Alert Executive Summary CISA and Federal Bureau of Investigation (FBI)'s July 22, 2025 joint advisory highlights Interlock ransomware as an emerging critical threat. Active since September 2024, this group targets North American and European organizations using sophisticated double extortion tactics, particularly focusing on healthcare, education, and critical infrastructure sectors. Key Attack Characteristics Interlock distinguishes itself through unconventional attack vectors. The group gains initial access via fake browser updates from compromised legitimate websites—an atypical method among ransomware operators. They also leverage "ClickFix" social engineering, tricking users into executing malicious PowerShell commands through fake CAPTCHA prompts. Technical Profile The ransomware operates cross-platform, targeting both Windows and Linux systems with particular focus on virtual machines. Using AES-CBC encryption, Interlock simultaneously locks systems and exfiltrates data through Azure AZCopy and Cloudflare tunnels. Cisco Talos reports an average 17-day dwell time before detection, during which operators conduct lateral movement via RDP and establish persistence through legitimate tools like AnyDesk. Defense Recommendations Organizations should implement multi-layered defenses including network segmentation, privileged access management, and enhanced #EDR capabilities. DNS filtering to block trycloudflare.com domains can disrupt #C2 communications. SOC teams must strengthen behavioral analysis capabilities as traditional signature-based detection proves insufficient against Interlock's evasion techniques. Threat Outlook The group's increased activity volume in June 2025 and adoption of new techniques like #FileFix indicate growing operational maturity. Organizations should update incident response plans, test backup procedures, and enhance VM infrastructure monitoring to address this evolving threat. Based on https://lnkd.in/dv9RdF8q #CyberSecurity #ThreatIntelligence #Ransomware #CISA #InfoSec

41

2024 set in motion major changes for certificate lifespans and DCV. In this Root Causes Podcast lookback episode Jason Soroko and I discuss the Apple 47-day proposal, stepping down certificate term, public versus private CA use cases, DCV reuse periods, MPIC, WHOIS, and other topics. Audio: https://lnkd.in/gH3Z-adY Video: https://lnkd.in/gN_VpVPy #pki #security

29

This week I was at the 13th annual All Things Open Conference in lovely Raleigh. Jenn, you work in security. Why are you at an OSS conference? Because understanding what’s going on in the OSS (and developer) community is crucial to understanding what AppSec teams will have to secure. In fact this conference was specifically recommended by a security engineer! This was going to be a post about the trends I saw, but really it’s just one big trend…🤖 AI AI and Development Practices: Integrating AI and large language models into software development and DevOps workflows. Open Source and AI: Exploring the reciprocal relationship between open-source philosophy and the development and future of AI technologies. Specialized AI Topics: Technical deep dives into subfields, including data, machine learning, and the underlying hardware and infrastructure. 🛡️what do AppSec people need to know? I observed growing awareness amongst attendees and speakers that AI has security concerns. That tells me this is a perfect time for security teams to talk with dev teams about how you can work together on using AI safely. Maybe do some threat modeling, set up a some lunch-and-learns, and form a working group.

40

5 Comments

Stop whining about how much CMMC costs; It pales in comparison to the costs of not adequately defending your networks, and not just for you but all the taxpayers funding it. CMMC is about compliance and real security. While nation-state espionage represents a significant threat to the Defense Industrial Base, cybercrime presents the most immediate and operationally disruptive risk to your organization's daily operations and long-term viability. Cybercrimes occur every 39 seconds—translating to 2,244 incidents per minute and 3.2 million attacks daily. In 2022, 49% of US internet users experienced cybercrime. Global cybercrime damages are projected to reach $10.5 trillion annually by 2025, up from $3 trillion in 2015—making cybercrime the world's third-largest economy, trailing only the United States and China. Data theft for extortion has become nearly ubiquitous in modern cybercrime operations. Any Department of Defense data you have failed to properly identify, classify, and protect walks right out the door with along with all your other data. Whether the threat actor is China, Russia, or a financially motivated cybercriminal group, the result is the same: you have lost control of data critical to national security; and you will have to report it to the DoD along with your other stakeholders. Additionally, inaccurate Self-Assessment reporting to the DoD carries serious consequences and it is time we started treating it as such. When you sign a DFARS clause, you are making a commitment to the government and fellow taxpayers that you will maintain adequate cybersecurity controls. Achieving CMMC Compliance is not just a regulatory requirement but critical to safeguarding national security data. Knowingly or unknowingly providing false information about your cybersecurity posture can be considered breach of contract and potentially a charge under the False Claims Act. One of the most pressing challenges facing defense contractors is identifying and securing Controlled Unclassified Information (CUI) within their environments. Many organizations struggle with culling through millions of files to locate and properly protect all CUI they have been entrusted to safeguard. The first question is whether you have CUI in your environment, the second question is whether you know where it is and how to protect it before it's too late. P.S. If you are not completely confident on where you really are in compliance and actual security, we are happy to help with any or all of it. #capeendeavors #teramis #cmmc #cybersecurity #cyberthreats

34

1 Comment