Steve Zalewski

Jason Soroko and I explain the major news items from the most recent CA/Browser Forum face-to-face meeting in Tokyo on the Root Causes Podcast. Topics include MPIC, 47-day certificate term, and Temporary Restraining Orders. Audio: https://lnkd.in/g-RaJifc Video: https://lnkd.in/gDJuyRAg

34

1 Comment

After lengthy late-night discussions with Cédric Bonhomme on sightings and KEV formats, we produced a first draft of a generic format for Known Exploited Vulnerabilities (KEV).  Initially, we considered extending GCVE BCP-05 using the CVE Record format. However, we ultimately concluded that it may be more appropriate to define a standalone format, allowing sources to publish their KEV data independently. Feel free to comment on the discourse link below. KEV Assertion Format – Draft Specification (potential BCP?) This format describes a generic KEV (Known Exploited Vulnerability) assertion format. The goal is to express who claims exploitation, when, based on what, where it was observed, and with which level of confidence, without turning KEV into full threat intelligence. A KEV assertion is usually very binary and lacking some meta-information. The format adds some information which could better capture details about the exploitation. A majority of the fields are optional except vulnerability, status and evidence.[].source which are recommended. 🔗 https://lnkd.in/eaBUFXie GCVE-EU CIRCL (Computer Incident Response Center Luxembourg) CVE Program

145

11 Comments

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

CISA has published a draft of the new CISA SBOM Minimum Elements! The 2021 NTIA Minimum Elements were an important step to help create a common specification of what should be in an SBOM. CISA is proposing an updated, clarified version that can be aligned with existing tools and support use cases. They are actively seeking feedback, so please share, review, and send them your thoughts! https://lnkd.in/eRm_zxT2

201

13 Comments

In another significant move, the Multi-State Information Sharing and Analysis Center (MS-ISAC) has lost its federal funding due to redundancy with other services provided by the Cybersecurity and Infrastructure Security Agency (CISA). This decision is expected to save taxpayers approximately $10 million annually. While cost savings are always welcome, the impact on state and local cybersecurity operations cannot be overstated. Federal Funding Cut: MS-ISAC's loss of federal funding means state and local governments must now rely more heavily on CISA's services. This shift requires a strategic approach to ensure continued cybersecurity resilience. Cost Savings: While the $10 million annual savings seems like a clear benefit, it's crucial to balance this with the potential risks of losing specialized support that MS-ISAC provided to over 18,000 entities. It also adds strain to CISA, which has seen 130 positions cut this year so far. Impact on States: State and local officials valued MS-ISAC's resources, including intelligence briefings, incident response support, and penetration testing. The loss of these services will create gaps in their cybersecurity posture. It is not clear if CISA will be able to perform all functions of MS-ISAC, but it seems unlikely. State officials have expressed concerns over the loss of MS-ISAC's services, emphasizing their importance in safeguarding elections and overall cybersecurity. State and local governments should fully utilize CISA's security advisers and services for cybersecurity and physical security assessments. The loss of MS-ISAC's federal funding is a wake-up call for state and local governments to immediately reassess their cybersecurity strategies and be prepared to fill in any gaps: likely on their own. Read more at StateScoop: https://lnkd.in/ehhAT6nZ

18

1 Comment

We've published cheat sheets for the first three volumes of NIST's new Digital Identity Guidelines! If you're planning on reading SP 800-63-4, 63A-4, or 63B-4, visit the Trusted Cyber Annex site (link in the comments) and download our cheat sheets for free. They not only highlight the recommendations and other information that we think are the most important, but they also include the NIST definition of each term next to where that term is first used. These additions make the Digital Identity Guidelines easier and faster to absorb. Please spread the word about this work! We are 100% reader-supported, so we rely on you to help us reach the cybersecurity community. Thank you!

56

8 Comments

By 2028, Gartner predicts that 70% of Chief Information Security Officers (CISOs) will adopt an Identity Visibility and Intelligence Platform (IVIP) to reduce their IAM attack surface. Stay ahead of the curve with insights from the 2025 Gartner Report on Reducing IAM Attack Surface. Download the report here: https://lnkd.in/gZY6SfBA #CyberSecurity #IAM #GartnerInsights #ISPM

46