Michael Manzi

CISA has published a draft of the new CISA SBOM Minimum Elements! The 2021 NTIA Minimum Elements were an important step to help create a common specification of what should be in an SBOM. CISA is proposing an updated, clarified version that can be aligned with existing tools and support use cases. They are actively seeking feedback, so please share, review, and send them your thoughts! https://lnkd.in/eRm_zxT2

201

13 Comments

📘 Now available: The CMMC Assessment Handbook – Final Rule Edition Aligned with the 48 CFR CMMC Final Rule (effective Nov 10 2025) and the multi-year rollout. This update introduces 8 Scope-Reduction Techniques, new worked examples, and clarified SSP guidance to help assessors and OSCs build defensible, right-sized CUI boundaries. ⬇️ Download the summary PDF below or get the full edition: https://lnkd.in/gT7haF4W #CMMC #Cybersecurity #Compliance #DIB #NIST #GRC

52

15 Comments

NSA, CISA, EPA, FBI, and allied cyber agencies published prescriptive guidance for building and maintaining an OT asset inventory and taxonomy—the foundation for a modern, defensible OT architecture. If you already run RedSeal, you can fulfill most of the guidance quickly by modeling your hybrid networks, auto-grouping assets into OT zones, validating segmentation, and continuously monitoring drift. If you don't there are manual processes outlined in the guidance.  #redseal #cybersecurity #OTsecurity #CTEM https://lnkd.in/gYdnbntX

23

1 Comment

🔐 Happy to help with a new initiative from Aspen Digital's US Cybersecurity Group: Playing Offense, a project exploring the strategic shift from reactive cyber defense to proactive offense. Historically, offensive cyber actions were viewed as too risky, escalatory, or unreliable. That mindset is evolving. Through this series, members of the US Group and other thought leaders unpack what a whole-of-nation offensive cyber strategy could look like. We’ll examine emerging risks and opportunities, the evolving role of the private sector, and the frameworks needed to move forward. 📘 First in the series: “On the Same Page: A Common Language for Understanding Offensive Cyber Action�� by Kemba Walden “Offense Won’t Cut it Alone: Don’t Forget the Cyber Fundamentals” by Sean Joyce Explore the project ➡️ https://lnkd.in/eRKZ2rdN #AspenCyber #OffensiveCyber #Cybersecurity #NationalSecurity #Leadership Vaibhav Garg, PhD

79

2 Comments

🚨 The Cybersecurity Information Sharing Act (#CISA) protections quietly expired this week. For the past decade, CISA enabled organizations to share cyber threat intelligence with government and peers under legal safeguards. With those protections gone, companies may think twice before collaborating — just as threat actors are ramping up their tactics. This moment is a reminder of how vital #trust and #transparency are in collective defense. Even without legal frameworks, security teams will need to find ways to keep intelligence flowing and risks visible. #CyberSecurity #ThreatIntelligence #CollectiveDefense

18

U.S. Department of Health and Human Services (HHS) issued a proposed Rule to modify the Health Insurance Portability and Accountability Act (HIPAA) to strengthen cybersecurity protection. Some highlights are mandatory MFA for systems storing and accessing personal data, Network Segmentation, require a vulnerability scan every 6 months and annual Pen Test, plus many more in the link. #HIPAA #Cybersecurity #HealthcareIT #DataProtection #ePHI #HealthcareSecurity #ComplianceUpdate #HealthTech #PrivacyLaw #HealthcareInnovation #infoSec #informationSecurity #MFA https://lnkd.in/e5qCvgYX

21

👉 On July 29, FBI and CISA released an updated joint advisory on Scattered Spider threat actors, revealing new TTPs obtained through investigations as recently as June 2025. According to the advisory, "Scattered Spider threat actors typically engage in data theft for extortion and also use several ransomware variants, most recently deploying DragonForce ransomware alongside their usual TTPs." The update highlights several concerning developments: 📍 "Scattered Spider threat actors may exfiltrate data from targeted organization's systems for extortion and then encrypt data on the system for ransom" 📍 "In many instances, Scattered Spider threat actors search for a targeted organization's Snowflake access to exfiltrate large volumes of data in a short time, often running thousands of queries immediately" 📍 "Scattered Spider threat actors may have deployed DragonForce ransomware onto targeted organizations' networks, thereby encrypting VMware Elastic Sky X integrated (ESXi) servers" The international advisory, co-authored by FBI, CISA, RCMP, Australian ACSC, AFP, Canadian CCCS, and UK's NCSC, details the group's evolution from traditional social engineering to more sophisticated multilayered operations targeting airlines, retail, and insurance sectors. The threat actors continue to leverage legitimate remote access tools like AnyDesk and Teleport.sh while conducting spear phishing calls to convince IT help desk personnel to reset passwords and transfer MFA tokens.

38

2 Comments

CISA Issued an Emergency Directive on the F5 Breach What We Know So Far 👉On October 15, 2025, CISA released Emergency Directive ED 26-01, compelling federal civilian agencies to inventory, patch, isolate, or decommission vulnerable F5 devices. 👉 The breach stems from a nation-state actor gaining persistent access to F5’s internal development and engineering systems starting in August 2025. 👉Exfiltrated data reportedly includes segments of the BIG-IP source code and F5 asserts there’s no evidence of tampering with its build pipelines or supply chain, nor confirmed exploitation of undisclosed vulnerabilities. 👉That said, some stolen files may include configuration or implementation data tied to a limited subset of customers, which could offer threat actors insight into deployment patterns. What Organizations & Customers Should Know: 1. Inventory your F5 footprint: Catalog all physical and virtual F5 devices (BIG-IP, F5OS, BIG-IQ, etc.). 2. Evaluate exposure: Check for public internet access to management interfaces; reduce or eliminate such exposure. 3. Apply patches immediately: Apply F5’s October 2025 updates. Prioritize modules with known vulnerabilities. 4. Retire or isolate unsupported hardware: If a device is end-of-support or cannot be securely patched, plan decommissioning or isolation. 5. Enhance logging, monitoring, and threat hunting: Monitor for suspicious changes, credential use, lateral movement, and configuration drift. 6. Engage in forensic review if signs of compromise emerge: If you detect anomalies, coordinate with incident response and your F5 contacts. Big shoutout to Matt Johansen for his clear and concise breakdown on Vuln U. Great resource to follow along on what the latest is (see link below).

32

6 Comments

We should all be concerned what happens to things like NIST CSF, 800 series, CISA guidance about these, and more. Even more so since Ron Ross, arguably the architect and creator of many of these things so many follow has retired. If your company has aligned to NIST frameworks, guidelines, and/or standards whatsoever, you should be thinking about contingency plans if it all goes poof. You can download files, but think about if they’re never updated again and no new guidance is provided. IMO, the only “safe” one is CMMC and NIST 800-171. Since the government is requiring them in contracts, I see that one likely surviving. Everything else is at risk and this risk should be added to your risk register with mitigation plans. Make sure you’re always thinking about meta objects on your risk register. It’s not just unpatched devices or network segmentation. It’s things like this (the frameworks you’ve built it on going away), board mindset changes (loss of program support), a new regulatory body appearing, and more that also need to be discussed with contingency plans in place.

80

23 Comments

93% of companies struggle with ICS/OT cyber security. That percentage is probably even higher. Most companies struggle because of a lack of understanding. And that leads to a lack of planning. It's more about awareness than budget. Though budget does play a big part. Especially as you mature. The CSF v2 can help you plan a new ICS/OT cyber security strategy. Or help you improve an existing one. While the framework is mostly associated with the IT world, it can be used to help you with your ICS/OT cyber security program. Working the six phases into your environment. 1. Identify Planning for the worst to happen. And what you need to do to prevent it. -> Identify your assets -> Perform risk assessments -> Develop your risk strategy 2. Protect Taking the steps to protect your environment. Implementing the security controls. -> Secure network architecture -> Vulnerability management -> Secure remote access 3. Detect Watching network/host activity for suspicious signs. Is something bad happening in your ICS/OT network? -> Threat hunting -> Threat detection -> Event correlation -> Continuous monitoring 4. Respond Can you respond efficiently when something bad happens? Are you able to limit the damage? -> Escalation -> Incident triage -> Communication -> Coordinating the incident response team 5. Recover How safely are you able to restore operations? How quickly? -> Rebuild/replace systems -> Restore from backup -> Restore operations 6. Govern -> Audit & review -> Metrics & reporting -> Policies & procedures -> Continuous improvement These are just a start of how the CSF v2 can guide you. If you already have an ICS/OT cyber security program... Never stop improving. If you don't have an ICS/OT cyber security program today... Don't wait! The attackers aren't! P.S. Do you think most organizations are prepared for an attack?

665

42 Comments

NIST CSF 2.0 marks a significant change in the perception and governance of cybersecurity, shifting it from a technical issue to a strategic business risk that demands attention from Boards and the C-Suite. Recent data from a Harris poll highlights the critical nature of cybersecurity, ranking it as the top geopolitical risk, surpassing concerns like climate change and trade wars. This transformation poses essential questions: Will this shift result in a deeper comprehension and increased backing for cybersecurity within companies? Or might it inadvertently create a disconnect between high-level strategy and practical implementation? I view this transition as an opening to involve and educate executives on their evolving roles in managing cybersecurity risks. Simultaneously, it necessitates contemplation on how we, as professionals, can guarantee harmony between strategic objectives and operational necessities. As we embrace this evolution, how can we collaboratively navigate this change to fortify both our organizations and the broader cybersecurity landscape? #Cybersecurity #NISTCSF #RiskManagement #ExecutiveEngagement

20

CMMC compliance is a business imperative – not a box to check. With Cybersecurity Maturity Model Certification requirements already appearing in contracts and full enforcement coming fast, defense contractors who delay may face more than high costs. They risk legal exposure, lost revenue and being shut out of future opportunities. With insight from #DoD #CIO Katie Arrington, #cybersecurity #risk and #compliance company CyberRx, and #Tech CEO Emile Sayegh, read my latest Forbes column to learn what leaders need to know about CMMC 2.0, the costs of certification and noncompliance, and why early action is your best competitive advantage. https://lnkd.in/e6t7Rm83 Ola Sage Israel Briggs Greg Smith Matt Grinstead Rachel Bamgbose #CMMC #CMMCCompliance #Cybersecurity #LeadershipStrategy #DefenseContracting #RiskManagement #GovCon

31

2 Comments