Timothy Eades

Amy Bogac is one of my favorite people in infosec! Everyone needs to listen to her perspective on how we've allowed SaaS to condition business leaders into thinking that data recovery is equivalent to disaster recovery -- IR plans & TTX must prepare us for both because you can't always trust your data or the hardware it's stored on. Having to do things like restate your financials is not an indicator of successful recovery.

3

Announcing a Valuable New Data Security Incident Response Service! Did you know that data is the fastest growing attack surface in the world? Your organization’s data is vulnerable to numerous potential risk scenarios that require specific evaluations to get ahead of them. This makes Data Security Incident Response a vital component of your organization's cybersecurity strategy. Cyera recently announced their Data Security Incident Response service which allows organizations to leverage and retain a team of elite cybersecurity practitioners to evaluate and respond to data security incidents post breach, helping you identify data security risks, remove ambiguity related to materiality, and determine the fastest path to recovery. Essential in this age of Data Sovereignty and the era of global privacy / regulatory compliance! Viva Cyera! Learn more about our Incident Response service today:

42

12 Comments

Today, Nucleus Security announced our sponsorship of the inaugural EPSS (Exploit Prediction Scoring System) report from Cyentia Institute. This report evaluates EPSS performance over the last few years and drills into questions related to understanding vulnerability exploitation in the wild. I'm adding links to the report and related resources in the comments. #cybersecurity #EPSS #NucleusSecurity #vulnerabilitymanagement

22

3 Comments

CMMC is final! - The rule is out for you to peruse: https://lnkd.in/gn-E5tT2 Here are the change summary Changes have been made to the CMMC Significant changes include: • The Implementation Phase 1 has been extended by an additional six months. • A new taxonomy was created differentiating the level and type of assessment conducted from the CMMC Status achieved as a result. • Clarification was added regarding the DoD’s role in achievement or loss of CMMC  Statuses. • CMMC Status will be automatically updated in SPRS for OSAs who have met standards acceptance. • Requirements regarding conflict of interest were updated to expand the cooling-off period for the CMMC Accreditation Body to one year and bounded the timeframe between consulting and assessing for the CMMC Ecosystem to three years. • A requirement was added for the CMMC Ecosystem members to report adverse information to the CAICO. • A Provisional Instructor role was added to cover the transitional period that ends 18 months after the effective date of this rule. • A CCI requirement was added to clarify that a CCI must be certified at the same or higher level than the classes they are instructing. • A requirement for artifact retention was added to Level 1 self-assessments and Level 2 self-assessments. • The assessment requirements for ESPs have been reduced. • The definition of CSP has been narrowed and is now based on NIST SP 800-145 Sept 2011. • The assessment requirements for Security Protection Assets and Security Protection Data have been reduced. • References to FedRAMP equivalency have been tied to DoD policy. • Clarified the requirements for CSPs for an OSC seeking a CMMC Status of Level 3 (DIBCAC). • Clarified that DCMA DIBCAC has the authority to perform limited checks of compliance of assets that changed asset category or changed assessment requirements between the Level 2 and Level 3 certification assessment. • Clarification was added around the use of VDI clients. • Provided clarification to distinguish between Plan of Action & Milestones (POA&Ms) and operational plan of action. #cmmc

14