Wireless routers are essential devices that provide internet connectivity to devices via Wi-Fi. However, they can also be a target for cyber attacks, especially if the security controls on the router are not configured properly or if they have vulnerabilities. Here are some common methods used by attackers to bypass security controls on wireless routers:

1. Default Passwords: Attackers often try to log in to a wireless router using default passwords, which are often easily guessable or readily available on the internet.
   
2. Brute-Force Attacks: Attackers use software programs to automate the process of guessing passwords, using common passwords or dictionary words.
   
3. Firmware Vulnerabilities: Attackers exploit known vulnerabilities in the firmware of a router, which can be used to bypass security controls and gain access to sensitive information.
   
4. Exploiting WPS: Wi-Fi Protected Setup (WPS) is a feature that allows users to easily connect devices to a wireless network. However, it can also be exploited by attackers who use brute-force attacks to guess the WPS PIN and gain access to the network.
   
5. Rogue Access Points: Attackers can set up rogue access points that mimic legitimate ones, tricking users into connecting to them and providing sensitive information.
   
6. MAC Spoofing: Attackers can change the Media Access Control (MAC) address of their device to match an authorized device on the network, bypassing MAC address filtering security controls.
   
7. Packet Sniffing: Attackers can use software to intercept and analyze wireless network traffic, potentially capturing sensitive information.
   
8. Denial of Service (DoS) Attacks: Attackers can overwhelm a wireless router with traffic, causing it to crash or become unresponsive, potentially allowing the attacker to bypass security controls and gain access to sensitive information.
   

To protect against these attacks, users should configure their wireless routers with strong passwords and firmware updates, disable WPS, implement MAC address filtering, and regularly monitor network traffic for suspicious activity. Additionally, users should consider using additional security measures, such as a virtual private network (VPN), to further secure their network and data.

Conducting an API security assessment involves several steps to identify potential security vulnerabilities, bugs, and flaws in the API code. The following is a general process for conducting an API security assessment:

1. Define the Scope: The first step in conducting an API security assessment is to define the scope of the assessment. This includes identifying the specific APIs to be tested, the types of vulnerabilities to be tested for, and the level of testing coverage required.
   
2. Discover the API: The second step is to identify all the endpoints of the API. This can be done manually, by reviewing the API documentation, or by using an API discovery tool to identify all the endpoints.
   
3. Identify Vulnerabilities: The next step is to identify potential vulnerabilities, such as injection attacks, authentication flaws, and access control issues. This can be done manually by reviewing the code, using automated tools or a combination of both.
   
4. Test the API: Once vulnerabilities have been identified, the API must be tested to determine whether they can be exploited. This can be done using a combination of manual and automated testing techniques, such as penetration testing, fuzzing, and vulnerability scanners.
   
5. Analyze Results: After the testing is complete, the results must be analyzed to identify potential vulnerabilities and to determine the severity of each vulnerability. This can be done manually, using automated analysis tools, or a combination of both.
   
6. Prioritize Vulnerabilities: Once the vulnerabilities have been identified and analyzed, they should be prioritized based on the level of risk they pose to the application or system. This can be done by assigning a severity rating to each vulnerability, based on factors such as the likelihood of exploitation and the potential impact.
   
7. Report Findings: Finally, the findings of the API security assessment should be documented and reported to the relevant stakeholders. This report should include a summary of the findings, detailed descriptions of each vulnerability, and recommendations for how to address each vulnerability.
   

Overall, conducting an API security assessment is a critical step in ensuring the security and resilience of an application or system. By following a structured process that includes discovery, vulnerability identification, testing, and analysis, organizations can identify potential vulnerabilities and take steps to mitigate them before they can be exploited by attackers

For more information about our CATSCAN service contact us.

Dynamic Application Security Testing (DAST) is a type of security testing that evaluates the security of web applications while they are running. In the context of a service provider selling DAST to a buyer, the service would involve the following steps:

1. Scope Definition: Proactive Risk as a example and buyer would define the scope of the testing by identifying the web applications to be tested, the specific vulnerabilities to be tested for, and the desired level of testing coverage.
2. Tool Selection: Proactive Risk would select the appropriate tools and technologies for the DAST service based on the scope of the testing. These tools would be used to automate the testing process and provide accurate and detailed results.
3. Testing Execution: Once the scope and tools have been defined, the service provider would begin the testing process. This involves running the selected DAST tools against the web applications to identify potential vulnerabilities, such as SQL injection or cross-site scripting.  A popular measurement is the OWASP Top 10 or OWASP ASVS.
4. Vulnerability Analysis: After the testing has been completed, the service provider would analyze the results to determine which vulnerabilities were detected and the level of severity of each vulnerability. They would also prioritize vulnerabilities based on the level of risk they pose.
5. Reporting: The service provider would create a report detailing the vulnerabilities identified during the testing process. This report would include a summary of the findings, detailed descriptions of each vulnerability, and recommendations for how to address each vulnerability.
6. Remediation: Based on the results of the testing and the report provided by the service provider, the buyer would take steps to address the vulnerabilities. This might involve patching software, updating configurations, or modifying user permissions.
7. Retesting: Once the vulnerabilities have been addressed, the Proactive Risk will conduct a follow-up DAST service to confirm that the vulnerabilities have been successfully remediated.

Overall, DAST is a critical component of any web application security program, and a service provider can provide valuable expertise and experience to ensure that the buyer's web applications are secure and protected from potential threats. By offering a comprehensive DAST service, Proactive Risk can help our customers to identify and mitigate potential security risks, and ultimately enhance the overall security and resilience of their web applications.

For more information about our CATSCAN service contact us

Social engineering is a tactic used by cybercriminals to trick individuals into divulging confidential information. Here are ten common ways social engineers gain access to confidential information:

1. Phishing: Social engineers send an email or message that appears to be from a legitimate source, such as a bank or company, and requests sensitive information like passwords or account details.
2. Baiting: Social engineers leave a tempting item, such as a USB drive or CD, in a public place in the hope that someone will pick it up and use it on their computer, which is infected with malware.
3. Pretexting: Social engineers create a fake persona or pretext, such as posing as an IT support person or government official, to trick individuals into divulging information.
4. Tailgating: Social engineers gain access to a secure area by following an authorized person, such as an employee or visitor, through a locked door.
5. Piggybacking: Social engineers gain physical access to a secure area by requesting entry while impersonating an authorized person or pretending to have a legitimate reason for entry.
6. Reverse social engineering: Social engineers make an individual feel important or valued in order to build trust and convince them to divulge confidential information.
7. Spear phishing: Social engineers send highly targeted and personalized messages to a specific individual or group in order to gain access to confidential information.
8. Phone phishing: Social engineers call individuals and pretend to be a legitimate source, such as a bank or company, in order to request confidential information.
9. Dumpster diving: Social engineers search through an organization's trash to find sensitive information, such as financial statements or employee records.
10. Human hacking: Social engineers use a combination of these tactics and other psychological tricks to manipulate individuals into divulging confidential information.

In order to protect against social engineering attacks, individuals and organizations should be vigilant, exercise caution, and follow best practices for data security and privacy.

For more information about our CATSCAN services contact us today

I recently did a interview on the Reimagining Cyber Podcast about advancements in the software security industry. I then took some time to think about the Fortify product that I have worked with for so many years.  The pro and the con, what are your thoughts?

Here are some best practices for a small business that has purchased Microsoft Windows Server 2019:

1. Plan your deployment: Before deploying Windows Server 2019, it is important to plan your infrastructure and determine your specific needs and requirements. This includes determining the number of servers you will need, the roles and features you will need to install, and the hardware and software requirements.
2. Create a disaster recovery plan: It's important to have a disaster recovery plan in place to protect your data and systems in case of an unexpected event. This includes creating regular backups, testing your disaster recovery procedures, and having a plan in place for restoring services in case of an outage.
3. Keep your server and software updated: Regularly updating your server and software can help to ensure that your systems are secure and running optimally. This includes patching your server, updating your antivirus software, and ensuring that your software is compatible with Windows Server 2019.
4. Monitor your server's performance: Regularly monitoring your server's performance can help you identify and resolve issues before they become critical. This includes monitoring your server's CPU, memory, and disk usage, as well as monitoring your network's performance.
5. Secure your server: Windows Server 2019 has many built-in security features that can help protect your server from external threats. This includes implementing firewalls, using a strong password policy, and encrypting your data.
6. Train your IT team: Windows Server 2019 is a powerful and complex operating system that requires knowledge and skill to manage effectively. It's important to provide training to your IT team to ensure they have the necessary knowledge and skills to manage and maintain your server.

By following these best practices, you can help ensure that your Windows Server 2019 deployment is successful and that your small business is protected from potential security risks.  If you can get Windows Server 2022 the same rules apply. ​Notable differences between Window Server 2019 and Window Server 2022 include increased host memory from 24TB to 48TB. The Maximum Logical CPUs have also increased from 512 to 2048.

Physical and logical security convergence refers to the integration of traditional physical security measures (such as cameras, locks, and alarms) with computer-based security systems (such as network security, access control, and surveillance). This convergence allows for a more comprehensive and holistic approach to security, as it allows organizations to better protect their assets and personnel by considering both the physical and digital realms.

One of the main benefits of physical and logical security convergence is that it allows for better information sharing between different security systems. For example, an access control system can be integrated with a video surveillance system, so that if a door is opened without proper authorization, a video of the event can be automatically recorded. This can help organizations quickly identify and respond to security breaches.

Another benefit of physical and logical security convergence is that it allows for more efficient use of resources. By integrating different security systems, organizations can reduce the number of separate devices and systems that need to be managed and maintained. This can help lower costs and reduce the risk of system failures.

One of the main challenges of physical and logical security convergence is that it can be difficult to achieve. This is because different security systems are often developed by different vendors and use different protocols and standards. This can make it difficult to integrate different systems together, and can lead to compatibility issues.
Another challenge of physical and logical security convergence is that it can be difficult to manage. This is because as more systems are integrated, the number of variables that need to be considered can increase, making it more difficult to identify and respond to security breaches.
​
Overall, physical and logical security convergence can provide a more comprehensive and holistic approach to security, allowing organizations to better protect their assets and personnel. However, it can be difficult to achieve and manage, and requires careful planning and execution to be successful.

VMWare ESXi is a popular virtualization platform for running multiple Windows servers, including Active Directory, file, and print services. Here are some best practices for setting up a VMWare ESXi system for this purpose:

1. Hardware requirements: Ensure that the hardware on which the VMWare ESXi system is running meets the minimum requirements for the number of virtual machines you plan to run.
   
2. Network design: Design the network infrastructure to ensure that the virtual machines have access to the necessary resources and that there is enough bandwidth to support the workload.
   
3. Virtual machine configuration: Configure the virtual machines with the necessary resources, such as CPU, memory, and storage, to ensure that they perform well.
   
4. Active Directory: When setting up Active Directory, ensure that the domain controllers are properly configured and that there are enough of them to provide redundancy and failover.
   
5. File and print services: When setting up file and print services, ensure that the virtual machines have access to the necessary storage and that the storage is properly configured for optimal performance.
   
6. Backup and recovery: Implement a backup and recovery strategy to ensure that the virtual machines can be restored in case of a disaster.
   
7. Security: Implement security measures, such as firewalls and intrusion detection systems, to protect the virtual machines from cyber threats.
   
8. Monitoring and reporting: Implement monitoring and reporting tools to keep track of the performance of the virtual machines and the VMWare ESXi system.
   

By following these best practices, you can set up a VMWare ESXi system that can effectively run multiple Windows servers, including Active Directory, file, and print services, and ensure that they perform well and are secure.

Cisco Meraki is a cloud-managed networking solution that provides a wide range of features and functionalities to help organizations manage their networks. The best practice for configuring Cisco Meraki depends on the specific needs and requirements of the organization. However, there are some general guidelines that can be followed to ensure that the configuration is secure and efficient.

1. Start by planning the network architecture and layout: Before making any changes to the network, it is important to have a clear understanding of the organization's needs and requirements. This includes identifying the number of devices and users that will be connected to the network, as well as the locations of these devices and users.
   
2. Set up a VLAN (Virtual Local Area Network) structure: VLANs are used to segment the network and provide more granular control over network access. This can be used to create different networks for different departments or groups of users, and to provide additional security by isolating different parts of the network.
   
3. Configure firewalls: Cisco Meraki firewalls provide advanced security features that can help protect the network from external threats. It is important to configure the firewall settings to match the organization's security policies and requirements.
   
4. Use wireless access points: Cisco Meraki wireless access points provide a range of features that can be used to optimize the wireless network. This includes setting up wireless SSIDs, configuring wireless security settings, and implementing wireless-specific policies.
   
5. Implement Network Access Control (NAC): NAC is a security feature that can be used to control access to the network based on the user's device and network status. This can be used to ensure that only authorized devices are able to connect to the network.
   
6. Use VPNs: Virtual Private Networks (VPNs) can be used to provide secure remote access to the network. Cisco Meraki provides several options for VPNs, including client VPN and site-to-site VPN.
   
7. Monitor and troubleshoot: Cisco Meraki provides a range of tools that can be used to monitor and troubleshoot the network. This includes real-time network monitoring, network analytics, and troubleshooting tools.
   
8. Keep Software and Firmware updated: Keeping the software and firmware updated ensures that the devices have the latest security patches and features.
   

By following these best practices, organizations can ensure that their Cisco Meraki configuration is secure and efficient. Keep in mind that the best practice may vary depending on the specific needs and requirements of the organization.

A SonicWall firewall can be configured for optimum security by following these best practices:

1. Enable the SonicWall Security Services: Enable the SonicWall Intrusion Prevention Service (IPS), Gateway Anti-Virus (GAV), Anti-Spyware (AS), and Application Control (App Ctrl) services to provide comprehensive protection against known and unknown threats.
2. Create security policies: Create security policies that define how traffic is handled, including access control, encryption, and authentication. These policies should be based on the principle of least privilege, allowing only the necessary access.
3. Use multiple levels of security: Use multiple levels of security, including firewalls, intrusion prevention, and VPNs to provide defense in depth. This will help to protect against known and unknown threats and reduce the risk of a successful attack.
4. Keep the firmware up-to-date: Keep the firmware up-to-date to ensure that the firewall has the latest security patches and features. This will help to protect against known vulnerabilities and newly discovered threats.
5. Use strong passwords: Use strong passwords for all administrative accounts and change them frequently. Passwords should be at least eight characters long and include a mix of letters, numbers, and special characters.
6. Use two-factor authentication: Use two-factor authentication (2FA) to provide an additional layer of security for remote access. This will help to protect against unauthorized access and reduce the risk of a successful attack.
7. Monitor and log network activity: Monitor and log network activity to detect suspicious activity and to identify potential security breaches. This will help to identify potential threats and to respond quickly to any security incidents.
8. Regularly backup the configuration: Regularly backup the configuration of the firewall to ensure that it can be quickly and easily restored in the event of a failure or security incident.
9. Regularly test the security: Regularly test the security of the firewall by performing vulnerability scans and penetration tests. This will help to identify potential vulnerabilities and to ensure that the firewall is providing the level of protection required.
10. Have an incident response plan: Have a well-defined incident response plan in place to ensure that security incidents are handled quickly and effectively. This plan should include procedures for identifying, containing, and resolving security incidents.

It is important to remember that security configuration is an ongoing process and should be regularly reviewed and updated to ensure that it remains effective against new and emerging threats. Furthermore, a security audit by a professional should be performed periodically to ensure that the firewall is configured correctly and that all the best practices are followed.

icrosoft PowerShell is a powerful tool that can be used to automate various tasks in Azure, including the creation of users. One way to create multiple users in an Azure tenant is by using a .csv file that contains the necessary information for each user. In this tutorial, we will walk through the steps of using PowerShell to create users in an Azure tenant from a .csv file.

1. First, open the PowerShell ISE and connect to your Azure tenant by running the command Connect-AzAccount. You will be prompted to enter your Azure credentials.
   
2. Next, create a new .csv file that contains the necessary information for the users you want to create. The .csv file should have the following headers: "UserName", "Password", "DisplayName", and "MailNickname". Each row should contain the information for a single user.
   
3. Import the .csv file into PowerShell by running the command $users = Import-Csv -Path "path\to\file.csv". Replace "path\to\file.csv" with the actual path to your .csv file.
   
4. Loop through each user in the .csv file using the command foreach ($user in $users).
   
5. Within the loop, create a new Azure AD user by running the command New-AzADUser -UserPrincipalName $user.UserName -DisplayName $user.DisplayName -MailNickName $user.MailNickname -AccountEnabled $true -Password (ConvertTo-SecureString -String $user.Password -AsPlainText -Force)
   
6. End the loop by running }
   
7. Run the script and it will create users in your azure tenant.
   

Note: Make sure that you are running these commands in Azure AD PowerShell module and also that you have the necessary permissions to create users in your Azure tenant.
By following these steps, you can use PowerShell to automate the creation of multiple users in an Azure tenant from a .csv file. This can save a lot of time and effort compared to manually creating each user, especially if you need to create a large number of users.

When it comes to security, it's important for businesses to trust their service providers. Accreditation is a way for businesses to ensure that their service providers are meeting industry standards and that they are providing high-quality services.
​
One of the main reasons why businesses should buy security services from accredited service providers is that these providers have been independently vetted by a third party. This means that they have been assessed against a set of standards and have been found to meet or exceed those standards. This provides businesses with a level of assurance that they are working with a reputable and trustworthy provider.

Another reason why businesses should buy security services from accredited service providers is that these providers have a proven track record of success. Accreditation is not a one-time event; it must be renewed on a regular basis, meaning that providers must continuously meet the standards in order to maintain their accreditation. This means that businesses can trust that their providers have the necessary experience and expertise to provide high-quality security services.

Accreditation can also help businesses ensure that their service providers are keeping up with the latest technology and industry developments. Accreditation bodies often require providers to demonstrate that they are using the latest technology and that they are staying up-to-date with industry trends. This helps businesses ensure that their service providers are providing the most current and effective security solutions.

Moreover, Accreditation also ensures that the service providers are adhering to the regulations, laws and compliance requirement that are specific to the industry or sector they are operating in. This is especially important for businesses that operate in regulated industries, such as financial services or healthcare, where compliance with regulations is critical to maintaining the trust of customers and stakeholders.
​
Additionally, Accreditation also helps in building trust with the customers and partners. When a business is working with an accredited security service provider, it sends a message to its customers and partners that the business takes security seriously and that it is committed to protecting its own and its customers' assets and sensitive information.

In summary, businesses should buy security services from accredited service providers because these providers have been independently vetted, have a proven track record of success, are keeping up with the latest technology and industry developments, adhering to the regulations, laws and compliance requirements and also helps in building trust with the customers and partners. Accreditation is an important way for businesses to ensure that they are working with reputable and trustworthy providers and that they are getting the high-quality security services they need to protect their assets and personnel.

Active Directory (AD) is a critical component of any Windows Server environment, and proper configuration is essential for efficient administration. Here are some best practices for configuring Windows Server 2019 Active Directory for administration:

1. Implement Group Policy Objects (GPOs): GPOs are used to centrally manage and configure settings for users and computers within the AD domain. GPOs can be used to enforce security policies, configure software settings, and manage user accounts.
   
2. Use Organizational Units (OUs): OUs are used to organize and structure the AD environment. By creating OUs for different departments, teams, or groups of users, administrators can more easily manage and apply GPOs and permissions.
   
3. Utilize Active Directory Users and Computers: This tool is used to manage the user and computer accounts within the AD domain. This tool allows administrators to create, delete, and manage accounts, as well as assign permissions and group membership.
   
4. Utilize Active Directory Domains and Trusts: This tool is used to manage the AD domain structure and trust relationships between domains.
   
5. Implement a backup and recovery strategy: Regularly backing up AD is crucial to ensure that the organization's data can be recovered in case of an emergency.
   
6. Use Active Directory Administrative Center: This is a new feature of Windows Server 2019 that provides a modern, web-based interface for managing AD. It allows administrators to perform common AD tasks such as creating and managing user and computer accounts, managing GPOs, and monitoring the health of the AD environment.
   
7. Utilize Role-Based Access Control (RBAC): RBAC allows administrators to assign different roles and permissions to different users and groups, making it easier to delegate responsibilities and manage access to resources.
   
8. Use Global Access Groups: Global access groups are used to manage access to resources across the entire AD forest. This can be used to more easily manage access to resources such as servers, printers, and applications.
   
9. Regularly check for security vulnerabilities: Regularly check for security vulnerabilities and apply the necessary patches and updates to keep your AD environment secure.
   

By following these best practices, organizations can ensure that their Windows Server 2019 Active Directory is configured for efficient administration, while also maintaining a high level of security. It's important to note that the best practice may vary depending on the specific needs and requirements of the organization.

Small businesses are increasingly becoming the target of cyber attacks, making it important for them to take steps to protect themselves from hackers and social engineers.

​Here are 10 things that small businesses can do to protect themselves:

1. Implement strong passwords: Use strong and unique passwords for all accounts, and require employees to do the same.
2. Use two-factor authentication: Implementing two-factor authentication can add an extra layer of security to protect against hackers.
3. Keep software and systems up-to-date: Regularly update software and systems to ensure that security vulnerabilities are patched.
4. Use a firewall: Firewalls can help prevent unauthorized access to a business's network and protect against cyber attacks.
5. Train employees on security best practices: Educate employees on how to identify and avoid phishing scams, social engineering tactics, and other cyber threats.
6. Regularly back up important data: Regularly back up important data to ensure that it can be recovered in case of a cyber attack.
7. Use anti-virus and anti-malware software: Use anti-virus and anti-malware software to protect against malware and other malicious software.
8. Limit access to sensitive information: Limit access to sensitive information to only those employees who need it to perform their job duties.
9. Use a VPN: Use a virtual private network (VPN) to encrypt communications and protect against cyber attacks.
10. Have an incident response plan: Have an incident response plan in place to respond quickly and effectively in case of a cyber attack.

By following these best practices, small businesses can take steps to protect themselves from hackers and social engineers. It's important to remember that cyber threats are constantly evolving, so it's crucial for small businesses to regularly review and update their security measures.

​Scoring Matrix
Critical (9.0 – 10.0)
Vulnerabilities that score in the critical range usually have most of the following characteristics:

• Exploitation of the vulnerability likely results in root-level compromise of servers or infrastructure devices.
• Exploitation is usually straightforward, in the sense that the attacker does not need any special authentication credentials or knowledge about individual victims, and does not need to persuade a target user, for example via social engineering, into performing any special functions.
• This rating is given to flaws that could be easily exploited by a remote unauthenticated attacker and lead to system compromise (arbitrary code execution) without requiring user interaction. These are the types of vulnerabilities that can be exploited by worms. Flaws that require an authenticated remote user, a local user, or an unlikely configuration are not classed as Critical impact.
• Intruders can easily gain control of the host, which can lead to the compromise of your entire network security and may include full read and write access to files, remote execution of commands, and the presence of backdoors.

Impacts of Critical Severity Vulnerabilities
These vulnerabilities can allow attackers to take complete control of your resources. In exploiting this type of vulnerability, attackers could carry out a range of malicious acts including (but not limited to):

• Stealing information (for example, user data)
• Tricking your users into supplying them with sensitive information (for example, credit card details)
• Defacing your website

By exploiting a critical severity vulnerability, attackers can access your website’s entire server. This allows them to acquire user and administrator information that might allow them to make changes such as delete or modify other user accounts.
On exploiting such vulnerabilities, attackers can access and control logged-in user or administrator accounts, enabling them to hijack accounts and make changes that typically only those users can.
Suggested Action for Critical Severity Vulnerabilities
A Critical severity vulnerability means that resources can be exploited at any time. It is advised to make it the highest priority to fix these vulnerabilities immediately via patching, upgrading or other mitigation measures. Once a fix action has been implemented, rescan the affected resource to ensure the vulnerability or weakness has been mitigated.
High (7.0 – 8.9)
Vulnerabilities that score in the high range usually have some of the following characteristics:

• The vulnerability is difficult to exploit.
• Exploitation could result in elevated privileges.
• Exploitation could result in a significant data loss or downtime
• This rating is given to flaws that can easily compromise the confidentiality, integrity, or availability of resources. These are the types of vulnerabilities that allow local users to gain privileges, allow unauthenticated remote users to view resources that should otherwise be protected by authentication, allow authenticated remote users to execute arbitrary code, or allow remote users to cause a denial of service.
• Intruders can possibly gain control of the host, or there may be potential leakage of highly sensitive information. For example, vulnerabilities at this level may include full read access to files, potential backdoors, or a listing of all the users on the host.

Impacts of High Severity Vulnerabilities
On exploiting such vulnerabilities, attackers can view information about your system that helps them find or exploit other vulnerabilities that enable them to take control of your website and access sensitive user and administrator information.
Suggested Action for High Severity Vulnerabilities
A High severity vulnerability means that resources can be exploited and attackers can find other vulnerabilities which have a bigger impact. Fix these types of vulnerabilities immediately. Once a fix action has been implemented, rescan the affected resource to ensure the vulnerability or weakness has been mitigated.
Medium (4.0 – 6.9)
Vulnerabilities that score in the medium range usually have some of the following characteristics:

• Vulnerabilities that require the attacker to manipulate individual victims via social engineering tactics.
• Denial of service vulnerabilities that are difficult to set up.
• Exploits that require an attacker to reside on the same local network as the victim.
• Vulnerabilities where exploitation provides only very limited access.
• Vulnerabilities that require user privileges for successful exploitation.
• This rating is given to flaws that may be more difficult to exploit but could still lead to some compromise of the confidentiality, integrity, or availability of resources, under certain circumstances. These are the types of vulnerabilities that could have had a Critical impact or High impact but are less easily exploited based on a technical evaluation of the flaw, or affect unlikely configurations.
• Intruders may be able to gain access to specific information stored on the host, including security settings. This could result in potential misuse of the host by intruders. For example, vulnerabilities at this level may include partial disclosure of file contents, access to certain files on the host, directory browsing, disclosure of filtering rules and security mechanisms, denial of service attacks, and unauthorized use of services, such as mail-relaying.

Impacts of Medium Severity Vulnerabilities
By exploiting Medium Severity Vulnerabilities, attackers will gain information and reconnaissance useful for their attack. Medium Severity vulnerabilities are often used to better understand your system, allowing them to refine and escalate the attacks. Such vulnerabilities can sometimes be connected, to increase the potential damage of the attack.
Suggested Action for Medium Severity Vulnerabilities
Most of the time, since the impact of Medium severity vulnerabilities is not direct, you should first focus on fixing High severity vulnerabilities. However, Medium severity vulnerabilities should still be addressed at the earliest possible opportunity.
Low (0.1 – 3.9)

• Vulnerabilities in the low range typically have very little impact on an organization’s business. Exploitation of such vulnerabilities usually requires local or physical system access.
• Intruders may be able to collect sensitive information from the host, such as the precise version of software installed. With this information, intruders can easily exploit known vulnerabilities specific to software versions.
• This rating is given to all other issues that have a security impact. These are the types of vulnerabilities that are believed to require unlikely circumstances to be able to be exploited, or where a successful exploit would give minimal consequences.

Impacts of Low Severity Vulnerabilities
Do not overly concern efforts towards resources with low severity vulnerabilities. These types of issues do not have any significant impact and are likely not exploitable.
Suggested Action For Low Severity Vulnerabilities
If time and budget allows, it is worth investigating and fixing Low severity vulnerabilities .
Informational

• Intruders can collect information about the host (open ports, services, etc.) and may be able to use this information to find other vulnerabilities.
• If this vulnerability exists on your system, intruders can collect information about the host (open ports, services, etc.) and may be able to use this information to find other vulnerabilities.
• Information may include NTLM Authorization Required, Email Address found, Robots.txt discovered, Web server version exposed, WAF detected, web server listening on port 80, telnet running, etc..

Impacts of Informational Alerts
Reported simply as supporting information for a resource, as they may not have a direct impact but could help an attacker to gain a better understanding of your underlying systems.
Suggested Action for Informational Alerts
In most cases, no action or fix is required.

Want to find out how many issues you have?  Contact us today and ask about CATSCAN from ProactiveRISK

The Gramm-Leach-Bliley Act (GLBA) is a federal law that requires financial institutions, including accounting and CPA businesses, to protect the privacy of customers' nonpublic personal information (NPI). The GLBA safeguard rules provide specific guidelines for how financial institutions should protect this information. Here are some steps that accounting and CPA businesses can take to comply with the GLBA safeguard rules:

1. Conduct a risk assessment: A risk assessment will help identify potential vulnerabilities in the organization's information systems and processes. This will help determine what types of safeguards are needed to protect customer NPI.
2. Implement administrative, technical and physical safeguards: GLBA requires financial institutions to implement a variety of safeguards to protect customer NPI. Administrative safeguards include policies and procedures for protecting NPI, such as access controls, incident response plans and employee training. Technical safeguards include firewalls, intrusion detection systems, and encryption. Physical safeguards include secure storage and disposal of NPI.
3. Limit access to NPI: Access to NPI should be limited to only those employees who need it to perform their job duties. This can be done by implementing role-based access controls, which restrict access based on an employee's role or job responsibilities.
4. Train employees: Employee training is essential for ensuring that employees understand the importance of protecting customer NPI and know how to do it. This training should be provided on a regular basis and should include information on the organization's policies and procedures for protecting NPI.
5. Review and update policies and procedures: Policies and procedures for protecting NPI should be reviewed and updated regularly to ensure that they are in compliance with the GLBA safeguard rules.
6. Conduct regular audits: Regular audits can help identify potential vulnerabilities in the organization's information systems and processes, and can be used to determine whether the safeguards in place are effective.
7. Maintain records of compliance: Financial institutions are required to maintain records of their compliance with the GLBA safeguard rules. This includes records of risk assessments, employee training, and audits.

By following these steps, accounting and CPA businesses can comply with the GLBA safeguard rules and protect the privacy of their customers' nonpublic personal information. It's important to note that compliance with the GLBA safeguard rules should be an ongoing process and policies and procedures should be updated regularly to stay in compliance.

Cybersecurity is a critical concern for businesses of all sizes and industries. With the increasing reliance on technology, businesses have become vulnerable to cyber attacks, data breaches, and other forms of cybercrime. The potential consequences of a cyber attack can be devastating and far-reaching, including financial losses, reputational damage, and legal liabilities. Therefore, it is essential that businesses take a proactive approach to managing cyber security risks.

One of the main reasons businesses should be proactive about cyber security risks is that the threat landscape is constantly evolving. Hackers and cybercriminals are constantly developing new techniques and strategies to breach security systems and steal sensitive information. Businesses that do not stay up-to-date with the latest security threats and trends will be more vulnerable to attacks. By being proactive and constantly monitoring the threat landscape, businesses can identify potential vulnerabilities and take steps to mitigate them before they are exploited.

Another reason why businesses should be proactive about cyber security risks is that the costs of a cyber attack can be significant. A data breach can result in the loss of sensitive information, such as customer data, financial records, and confidential business information. This can lead to financial losses, legal liabilities, and reputational damage. In addition to the direct costs, businesses may also face indirect costs, such as lost productivity, lost customers, and the need to invest in additional security measures. By being proactive and implementing effective security measures, businesses can reduce the likelihood of a cyber attack and minimize the potential costs.
Proactivity also helps to protect your company's reputation. A cyber attack can seriously damage a company's reputation, as customers and partners may lose trust in the company's ability to protect their sensitive information. This can lead to long-term damage to the company's brand, and it may be difficult to regain customer trust once it is lost. By being proactive and implementing effective security measures, businesses can prevent data breaches, protect customer data, and maintain a positive reputation.

Additionally, with more and more regulations coming into place, it is important for businesses to be proactive about cybersecurity to avoid the legal and financial consequences of non-compliance. Many states and countries now have laws requiring companies to disclose data breaches, and businesses may face significant penalties for failing to comply with these regulations. By being proactive and implementing security measures that comply with relevant regulations, businesses can avoid legal liabilities and fines.
​
In conclusion, being proactive about cybersecurity is essential for businesses of all sizes and industries. The threat landscape is constantly evolving, and the costs of a cyber attack can be significant. By identifying potential vulnerabilities and implementing effective security measures, businesses can reduce the likelihood of a cyber attack and minimize the potential costs. Proactivity also helps to protect the company's reputation, and it is important to comply with the relevant regulations. Businesses that fail to take a proactive approach to managing cyber security risks will be more vulnerable to attacks and face greater consequences. It is important to remember that cyber security is not a one-time or occasional task, it should be an ongoing process, regularly monitored, and updated.

It is difficult to predict exactly what will happen in the field of cybersecurity in 2023, as it is constantly evolving and there are many factors that can influence its development. However, it is likely that there will be a continued focus on protecting against cyber threats and vulnerabilities, and there may be a number of significant developments in the field over the next few years.
Some potential trends in cybersecurity in 2023 could include:

1. Increased use of artificial intelligence (AI) and machine learning: AI and machine learning technologies can be used to improve cybersecurity by detecting and responding to threats more quickly and accurately.
2. Greater emphasis on cloud security: As more businesses and organizations move to the cloud, there will be a need for better security measures to protect against threats to cloud-based systems.
3. Rise of the Internet of Things (IoT): As the number of connected devices continues to grow, there will be a need for improved security measures to protect against threats to these devices.
4. Increased focus on supply chain security: Cybersecurity threats can often originate from within an organization's supply chain, so there may be a greater focus on securing supply chain systems and processes.

Overall, it is important for businesses and organizations to stay up-to-date with developments in the field of cybersecurity and to implement appropriate security measures to protect against threats.

Security is a journey. It’s a collection of people, processes, and technologies operating at multiple layers within the organization that should work together to help strengthen a company’s overall security profile and ultimately protect its digital and non-digital assets. While journeys typically include a beginning and an end, I would argue that the security journey has no end. Good luck finding a CISO or security executive who will openly admit that their company has achieved security, or who can truthfully state that they are able to sleep through the night without any concern for the assets they’ve been charged to protect.
​
The task of securing a company’s assets is a daunting endeavor. With the constant barrage of automated alerts, weekly releases of newly discovered vulnerabilities, relentless and never-ending attacks from a growing list of known and unknown bad actors, the challenges posed by external forces appear to be never-ending. Coupled with constant requests from internal teams to use the latest unproven or untested technology and a queue full of internal requests to integrate and share data with external vendors, who can blame today’s security executive for losing sleep. While many battles within the security journey can be won, the security war is endless and rages on with no end in sight.

IT or security compliance is the activity that a company or organization engages in to demonstrate or prove, typically through an audit, that they meet the security requirements or objectives that have been identified or established by an external party. That list of security requirements could be as simple as a list of security objectives that a customer or business partner deems critical or pertinent to the established or proposed business relationship. It could also represent a much more complex and lengthier list of controls and objectives (i.e. security framework) which has been established by external professional organizations, specific industries, or government agencies.
It’s easier for a company, customer, or business partner to adopt an industry-recognized framework versus establishing their own set of criteria however some companies may have a framework dictated to them based on the industry they operate in or regulatory obligations, i.e. Payment Card Industry, Healthcare, DOD, etc. Recognized and established third party security frameworks, certifications or reports can include but are not limited to, ISO’s 27001, NIST’s 800-53, PCI, HIPAA, and SOC 2 reports. The resulting certifications or reports demonstrate to customers, business partners (i.e. user organizations) and potential regulators that the company or service organization has achieved compliance, per the opinion of an independent auditor, with the stated security controls and objectives identified within the applicable framework.
Demonstrating compliance with a recognized security report or certification helps relieve the burden from the service organization of having to open its doors to multiple auditors from several different user organizations that may want to validate the service organization’s security operations. It can also simplify a user organization’s vendor management process by being able to place reliance on the work of an independent auditor versus having to build out or expand their own technical audit team.

Yes and no. Passing a security audit or obtaining a certification or a report that demonstrates your organization complies with an industry-accepted security standard or framework is a big deal. It definitely adds value and strengthens the overall security program. Depending on the certification obtained, the achievement demonstrates that a company has invested time, money, and resources into its people, processes, and technology to both design, implement and operate in accordance with a defined security framework.
It is important to remember however that security compliance standards or frameworks aren’t a one size fits all and aren’t all-encompassing. It would be an impossible feat for one organization, regulatory body, or agency to define a security framework that identifies and mitigates all security risks for every company that chooses to adopt it. No two company’s security risk profile or technology landscape are the same. A security framework attempts to establish a baseline or identify a high-level suite of control activities that are applicable to all organizations regardless of their size, technology footprint, or industry.
In other words, IT compliance frameworks help to establish an excellent security foundation for additional security activities that a company should engage in based on identified risks, to secure their organization. So yes, security compliance absolutely helps a company establish, strengthen, and add value to its Information Security Management System. However, the security journey will require additional effort beyond the baseline control activities identified in a security framework.

Security compliance can identify gaps in a security program. Some security practitioners may have a difficult time identifying the benefits of security compliance within their security program. In their minds, security compliance may act more as an inhibitor to the company’s progress and efficiency rather than as a benefit. While strong security programs can be established without compliance, at times, some of the more foundational or baseline security controls can be overlooked or forgotten. This is typically the result of increasing demands being placed on security organizations and the need to place more focus on some of the more complex security risks facing a company.
For those organizations that aren’t required to adhere to a compliance framework, it has proven beneficial to perform a gap assessment against a recognized compliance standard. This validates if their security program addresses all identified baseline security controls. It can prove to be an eye-opening experience when potential gaps or areas for improvement are identified.

​Security compliance also helps to establish governance, formality, ownership, and accountability within your security program. Sometimes, security compliance may be referred to as a burden or a waste of time. However, the documentation requirements surrounding policy, procedure, frequency, and preservation of evidence should help to establish confidence that security objectives and control activities are uniformly understood throughout the organization and that assignments or ownership have been designated and defined. Clearly defined ownership surrounding risks, controls, and data also helps to establish accountability which instills more confidence in a team’s ability to execute against state objectives.

Security compliance reporting provides an effective and formal method to measure and evaluate performance against stated control objectives that otherwise may not occur. Again, the reporting should be considered an all-encompassing reflection of all security activities and initiatives within the company, but it should act as an effective report card regarding performance against the baseline set of controls identified by the adopted framework. When compliance with stated security objectives is measured and reported on via compliance reporting, a clearer picture can be established as to what areas of the security program may require more focus and attention, which further helps to prioritize and perhaps realign resources.
Compliance with a recognized security standard also helps strengthen a company’s reputation within the marketplace and continues to become the norm for business relationships as more scrutiny continues to be placed on a company’s internal security practices, their sub-service provider’s and those they choose to share data with. Compliance with a recognized security standard becomes even more critical when the data being processed includes PII, PCI, or PHI as the number of different privacy and security regulations continues to grow.

To sum it up, security compliance is not the be-all-end-all security silver bullet that at times it may be made out to be. Establishing an effective security program will require additional effort above and beyond demonstrating alignment with an applicable security framework. However, while achieving compliance with a security framework doesn’t represent the completion of the security journey, it does complement and provide several benefits to a company’s overall security program. It can demonstrate to external parties that security has been established as a critical component of the company’s overall business objectives and strategy.
Proactive Risk is an independent assessment firm that specializes cyber security. If you have any additional questions or are interested in retaining our services, please contact us.

I received a call this week from a fortune 500 business, they organization had a problem and wanted to do a meeting related to cyber security centrality analyst. I suggested that we engage with our standard agreement and schedule time to meet and go over the matter details.  Although we have published lots of guides and tools for FREE online there was a expectation that all knowledge and experience is "free".

The experience reminded me of the story of "The Giant Navy Ship"

A giant ship engine failed. The ship’s owners tried one expert after another, but none of them could figure but how to fix the engine.
Then they brought in an old man who had been fixing ships since he was a young. He carried a large bag of tools with him, and when he arrived, he immediately went to work. He inspected the engine very carefully, top to bottom.
Two of the ship’s owners were there, watching this man, hoping he would know what to do. After looking things over, the old man reached into his bag and pulled out a small hammer. He gently tapped something. Instantly, the engine lurched into life. He carefully put his hammer away. The engine was fixed!
A week later, the owners received a bill from the old man for ten thousand dollars.
“What?!” the owners exclaimed. “He hardly did anything!”
So they wrote the old man a note saying, “Please send us an itemized bill.
The man sent a bill that read:
Tapping with a hammer………………….. $ 2.00
Knowing where to tap…………………….. $ 9,998.00

Effort is important but knowing where to make an effort makes all the difference!
​

For an IT managed services company to effectively take over the helpdesk, operations, and security for a small business with 10-1000 devices as example, several key items and levels of access will need to be provided. This ensures the service provider has all the necessary tools and permissions to manage your IT infrastructure efficiently and securely.

Here's a general checklist:

1. Network Details:
   • Information about the existing network infrastructure, including diagrams, IP address ranges, DNS details, and network equipment configurations (routers, switches, firewalls).
   • Access to network management tools and platforms.
2. Hardware and Software Inventory:
   • Detailed list of all IT hardware (servers, computers, printers, mobile devices) including models, specifications, and locations.
   • Comprehensive software inventory, including operating systems, office software, specialized applications, and any custom-developed software.
3. Access Credentials:
   • Administrator-level access to servers, workstations, network devices, and other critical infrastructure.
   • Credentials for cloud services and SaaS applications used by the business.
4. Security Policies and Documentation:
   • Existing security policies, procedures, and any compliance documentation.
   • Details of previous security assessments, audits, or breaches, if applicable.
5. Backup and Disaster Recovery Plans:
   • Access to existing backup solutions and disaster recovery plans.
   • Information on current backup schedules, storage locations, and recovery procedures.
6. Vendor Contacts and Contracts:
   • Contact details for all relevant vendors, including hardware, software, and service providers.
   • Copies of current contracts and service level agreements (SLAs).
7. User Accounts and Permissions:
   • List of all user accounts, including administrative and service accounts, with details on their access levels and permissions.
   • Procedures for onboarding and offboarding employees.
8. Compliance Requirements:
   • Information on any regulatory or industry compliance requirements affecting the IT systems (e.g., GDPR, HIPAA).
   • Previous compliance reports or assessments.
9. IT Support and Incident Response History:
   • Records of past IT support tickets, common issues, and resolutions.
   • Incident response plans and logs of past security incidents.
10. Training Materials and Documentation:
    • Existing training materials, operational manuals, and documentation for IT systems and security protocols.
11. Communication Channels:
    • Preferred tools and protocols for communication between the business and the managed services provider.

By providing this comprehensive set of information and access, the IT managed services company can tailor their support, operations, and security measures to meet the specific needs of your business. It's important to have an initial meeting to discuss and agree upon the scope of services, expectations, and any specific business requirements. When combined with a simple and straighforward master services agreement and work order everyone involved make the transion logistics easy.

We invite you to download our complimentary Cybersecurity Checklist or explore our managed service, ManageIT, by ProactiveRISK for more detailed information. 

The Federal Trade Commission recently amended the Safeguards Rule, 16 C.F.R. § 314.1, et seq., with significant changes to how an information security program should be designed, what it must include, and who needs to be in charge.  Some may note the similarity to the New York Department of Financial Services’ Cybersecurity Requirements for Financial Services Companies, N.Y. Comp. Codes R. & Regs. tit. 23, § 500.00, et seq.
The Rule is now considerably lengthier, but not all the amendments added anything new or substantive.  In this article we will explain which changes look new but are not, which are new and substantial, which do not apply to small businesses, and when certain provisions go into effect.

THE RULE

The Rule was promulgated under the Gramm-Leach-Bliley Act which, in part, requires the FTC to issue rules setting forth standards that financial institutions must implement to safeguard certain information.  The Rule applies to customer information held by non-banking financial institutions and “sets forth standards for developing, implementing, and maintaining reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of [that information].”
The Rule provides this non-inclusive list of entities that are considered financial institutions under the Gramm-Leach-Bliley Act and subject to the rule:

• Mortgage lenders;
• Pay day lenders;
• Finance companies;
• Mortgage brokers;
• Account servicers;
• Check cashers;
• Wire transferors;
• Travel agencies operated in connection with financial services;
• Collection agencies;
• Credit counselors and other financial advisors;
• Tax preparation firms, non-federally insured credit unions;
• Investment advisors that are not required to register with the SEC; and
• Entities acting as finders.

Additionally, in its definitions, the Rule provides more detailed examples of entities considered financial institutions.

THE AMENDMENTS

The amendments to the Rule became effective Jan. 10, 2022, although some of the most important provisions are not effective until Dec. 9, 2022.  The FTC summarized the highlights as providing:

• More guidance on how to develop and implement specific aspects of an overall information security program.
• New provisions to improve the accountability of information security programs.
• Exemptions for financial institutions that collect less customer information.
• Inclusion of entities engaged in activities that are incidental to financial activities.
• New terms and examples.

WHAT’S NOT NEW

Section 314.1 – Purpose and Scope. Although amended subsection (b) appears significantly lengthier, it simply incorporates the definition of “financial institution” from the Privacy Rule, as modified and with examples, “to allow the Rule to be read on its own, without reference to the Privacy Rule.” 
Section 314.2 – Eleven Old Definitions. Previously, the Rule had only three defined terms and a general provision explaining that the terms used in the Rule had the same meaning as those defined in the Privacy Rule, 16 C.F.R. § 313.3.
Now, the Rule has 18 defined terms, but the majority have been carried over from the Privacy Rule to “improve clarity and ease of use.”  The Rule’s pre-amendment terms and those carried over from the Privacy Rule without substantive change are:

• Consumer;
• Customer;
• Customer Information;
• Customer Relationship;
• Financial Product or Service;
• Information System;
• Nonpublic Personal Information;
• Personally Identifiable Financial Information;
• Publicly Available Information;
• Service Provider; and
• You.

Section 314.3 – Standards for Safeguarding Customer Information. This section is essentially unchanged.

WHAT’S NEW

Section 314.2 – Seven New Definitions. As mentioned above, most of the defined terms are newly added to this section but not new to the Rule because they were previously cross-referenced to their definitions in the Privacy Rule.  Following are the seven new terms, and one that has been modified:

• Authorized User: This new term “means any employee, contractor, agent, customer, or other person that is authorized to access any of your information systems or data.”

• Encryption: This new term “means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key, consistent with current cryptographic standards and accompanied by appropriate safeguards for cryptographic key material.”

• Financial Institution: This term has been modified to include “any institution the business of which is engaging in an activity that is financial in nature or incidental to such financial activities. . .” (emphasis added). It specifically applies to “[a] company acting as a finder in bringing together one or more buyers and sellers of any product or service for transactions that the parties themselves negotiate and consummate is a financial institution because acting as a finder is an activity that is financial in nature or incidental to a financial activity listed in 12 CFR 225.86(d)(1).”

• Information Security Program: This new term “means the administrative, technical, or physical safeguards you use to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information.”

• Multi-Factor Authentication: This new term “means authentication through verification of at least two of the following types of authentication factors: (1) Knowledge factors, such as a password; (2) Possession factors, such as a token; or (3) Inherence factors, such as biometric characteristics.”

• Penetration Testing: This new term “means a test methodology in which assessors attempt to circumvent or defeat the security features of an information system by attempting penetration of databases or controls from outside or inside your information systems.”

• Security Event: This new term “means an event resulting in unauthorized access to, or disruption or misuse of, an information system, information stored on such information system, or customer information held in physical form.”

Section 314.5 – Effective Date. This section identifies certain provisions of § 314.4 that are not effective until Dec. 9, 2022, as described below.
Section 314.6 – Exceptions. This “small business” section identifies certain provisions of § 314.4 that “do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.”  Those provisions are identified below.

WHAT’S HOT

Section 314.4 – Elements. This section has been completely overhauled, and now explains with specificity the elements, new and old, that must be included in an information security program.  Except where indicated, these elements must be incorporated by Dec. 9, 2022.  In summary, the elements checklist includes:

• A single “qualified individual” designated to oversee, implement, and enforce the information security program. Previously, the program could be coordinated by a designated employee or employees. 

• An information security program based on a risk assessment. This is a current requirement, as well as the need to periodically perform additional risk assessments.  However, effective Dec. 9, 2022, the risk assessment must include, except for small businesses:
  • Criteria for the evaluation and categorization of identified security risks or threats;
  • Criteria for the assessment of the confidentiality, integrity, and availability of information, including the adequacy of the existing controls in the context of the identified risks or threats; and
  • Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the information security program will address the risks.

• Safeguards designed to control identified risks through:
  • Access controls, including technical and physical controls, to authenticate and limit access;
  • Identification and management of data, personnel, devices, systems, and facilities;
  • Encryption of all customer information held or transmitted;
  • Secure development practices and security testing for applications used for transmitting, accessing, or storing customer information;
  • Multi-factor authentication for any individual accessing any information system;
  • Procedures for the secure disposal of customer information no later than two years after the last date the information is used;
  • Procedures for change management;
  • Policies, procedures, and controls to monitor and log the activity of authorized users and detect unauthorized access, use or tampering.

• Regular testing and monitoring of the safeguards’ effectiveness. This general requirement is currently in effect, but new requirements effective Dec. 9, 2022, and not applicable to small businesses, are:
  • Annual penetration testing; and
  • Vulnerable assessments.

• Policies and procedures that include:
  • Security awareness training;
  • Use of qualified information security personnel to manage risks and oversee the program;
  • Security training and updates to address risks; and
  • Verification that information security personnel maintain current knowledge of changing information security threats and countermeasures.

• Service provider oversight through:
  • Selecting service providers capable of maintaining appropriate safeguards, which is a current requirement;
  • Requiring the safeguards by contract, which is also a current requirement; and
  • Periodically assessing service providers based on the risk they present and the adequacy of their safeguards, effective Dec. 9, 2022.

• A written incident response plan, with seven specific requirements, designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information. This is not required for small businesses.

• A regular written report, prepared at least annually, by the qualified individual to the board of directors that includes the status of, and compliance with the information security program, and any related material matters. This is not required for small businesses.

​
COMPLIANCE

​The elements described in § 314.4 are not new concepts and many entities are already compliant.  However, because the elements are now far more specific and detailed than before, we recommend those subject to the Rule compare its elements to those of their own programs to ensure compliance, leaving time for compliance by Dec. 9, 2022. 

Published in CPO Magazine  April 6th 2022
​
Post-COVID, a growing number of mid-sized businesses are merging with and acquiring other companies to adapt, grow and expand. This process takes a tremendous amount of preparation and research. From business financials and intellectual property to contracts and tax issues, there is much to be done to help ensure a successful M&A transaction.

Among top considerations during the M&A process should be your technical controls. In specific, you need to pay close attention to the software bill of materials (SBOM), and several other vital areas of your technology-enabled business. If the target organization cannot demonstrate technical maturity, it will be score lowered and may ultimately see a reduced acquiring offer or be a deal-breaker altogether.
During the due diligence process, be prepared to present and describe your software-based technology product with documentation. What is expected during a technical due diligence review is architectural diagrams, scalability, and performance metrics. Technology choices made, including programming languages, databases, and infrastructure choices, will be reviewed. Your key staff must also be able to describe any software development practices and provide details on continuous deployment environments..

In particular, a review of the OWASP Top 10 2021 List is recommended. Be certain that you are able to answer questions about how you ensure code quality in a hostile internet-connected environment and perform an independent third party code audit

Depending on the reason for the merger or acquisition, it could be equally important to have technical controls in place for the operations side of the business. Here it’s important to evaluate how data is processed in 17 key areas:

1. Access Controls focus on identifying and limiting the people and other entities allowed to access your systems. These controls also involve limiting the types of functions and transactions that those authorized users can perform.
2. Asset Management includes requirements for managing services and devices that store or interact with your data, whether on your network or hosted in the cloud.
3. Awareness and Training helps to demonstrate that the business has a training program for their staff, contractors, and vendors so that they are equipped to report and overcome threats they may encounter.
4. Audit and Accountability for all actions is necessary. Your business should have controls in place to track individual users’ activities, as well as various system activities.
5. Security Assessments.  Most organizations do not have an annual program to assess testing to make sure your system security plans are working. CREST can share lists and resources regarding International accredited service providers. For more information check out the Service Selection Platform.
6. Configuration Management lists the requirements for creating baseline configurations and inventories, as well as making actual changes to those systems. It also requires that your organization monitors for any unapproved changes that might occur.
7. Identification and Authentication is similar to Domain Access Controls in that they are focused on user access. However, in this case, the emphasis is on ensuring the person using an account is indeed the correct user.
8. Incident Response demonstrates that the organization has controls over, and has plans in place to anticipate security incidents. This also specifies what their response will be if any incidents occur.
9. Maintenance is based on the premise that all computer systems are vulnerable to failure at some point. That means your business should protect critical systems and data against vulnerabilities in the instance of a system failure. There should be a regular process of monitoring and re-evaluating how your security and backups are doing.
10. Media Protection covers the use of removable media to store data, including both electronic storage devices and paper. Storing information on removable media can be dangerous and leave you vulnerable, so it must be carefully controlled, and encrypted.
11. Physical Protections should be considered along with technological protections. Ask yourself, “How difficult would it be for someone to walk into my business and steal the hardware with its data?” This should be a good base for what is needed to secure your property.
12. Personnel Security asks if your business screens employees before allowing them to gain access to systems containing controlled unclassified information (CUI). It should also be considered that when an employee is transferred or terminated, and is no longer authorized to access data, how does your business plan to protect that data For example, what is your off-boarding process like? Are you organized with logs of who does and does not have access to your systems?
13. Recovery means regularly backing up your data. This is absolutely critical for preventing unnecessary data losses.
14. Risk Management demonstrates the maturity of the business. Have risk assessments of your data and systems taken place? What were the findings and corrective actions?
15. Situational Awareness. Organizations need to take intelligence regarding cyber threats from external sources seriously and respond to them appropriately. You should always have some level of awareness regarding your business and its security.
16. Systems and Communications Protection includes an extensive list of controls focused on securing the transmission of information within a system. It also prohibits the sharing of CUI on public forums. This might show itself in the encryption of emails and data loss prevention.
17. System and Information Integrity is the proactive monitoring for issues and then the  prompt application of security patches as needed. Demonstration of this process is defined as a policy, a procedure, and staff task assignments.

Remember – confidentiality, integrity and availability are important items of consideration for your technology choices from day one. Be certain to use company that has been accredited to perform valuable third-party assessments with proven policies, processes and procedures to validate your technology and environment. With a credible third-party validation of your technical maturity, you can ensure that the technical elements of your due diligence will enhance acquisition offers and simplify the integration process. 

For more information, contact us on how we can help you be proactive.