People carry less cash in their wallets than they used to.  Even when going to the ice cream stand in the middle of summer, a debit or credit card is swiped instead of cash being tendered.  The reason for this is simple - it’s easier to swipe a card than it is to carry a load of cash in your wallet.  This has become an extremely convenient option over the years when making purchases.  However, as is often the case, convenience comes with risk.

This month’s release of the much-anticipated CMMC 2.0 left many of us in the world of cybersecurity shaking our heads.  We have been working diligently with the defense industrial base for several years now, even before the CMMC was created, to stop the bleeding of our defense secrets to our adversaries.  As a veteran and a Patriot, I, along with many other Americans, take this very serious problem personally. 

In a previous blog post, we discussed how to calculate your SPRS (Supplier Performance Risk System) score in support of your CMMC (Cybersecurity Maturity Model Certification) efforts.  In that same blog, we also provided a free tool to help you calculate your SPRS score automatically.

In this follow-on blog, we’ll talk about how to provide your SPRS score to the DoD, which is a whole other chore once you’ve actually determined what your score is.  In order to access the part of the SPRS website where your score is uploaded, we first need a CAC (Common Access Card) or a DoD approved medium assurance ECA (External Certification Authority) certificate.  The primary purpose of this certificate is to ensure that the individual person entering the score is who they actually claim to be (non-repudiation), in addition to ensuring the confidentiality of the data.

Your company has been proactive in having a penetration test performed and you have the report in hand - so now what do we do with it?

Secure your Organization with the NIST Blueprint

Breaches are at all time high.  Over 50 billion devices are connected to the internet.  Some of them are secure, and some of them are not.  Which category does your organization fall into?

Let’s face it.  Security is expensive.  Many organizations think of security as an unwanted expense when budgeting for the next fiscal year.  However, no matter what industry an organization is in, security IS its business too.

Over the weekend, the Colonial Pipeline, one of the largest US pipelines and a major supplier for the East Coast, was hit by a cyber attack. A ransomware attack caused the company to shutdown operations as they work through the necessary steps to respond and recover, however the impact is expected to be significant if fuel terminals experience outages as a result in disruption to their supply.  The Colonial Pipeline supplies diesel, gasoline, and jet fuel.  The US government has issued an emergency waiver to allow an exemption for drivers related to hours of service, as well as exemptions related to fuel transportation via tanker ships.  To compound the supply issues further, the US is experiencing a shortage of fuel truck drivers, areas of the US are opening up further from COVID restrictions which is expected to increase travel, and we are approaching the summer travel season which notoriously increases fuel demands.

Data security isn’t a matter to be taken lightly, as too many businesses have found out the hard way. Unfortunately, there are far too many simple ways to correct common security issues - enough that it’s foolish not to do so. We’ll review a few ways to fix security issues, after discussing one of, if not the, most egregious security failings in modern history.

The password isn’t nearly as secure as it used to be. Hackers have begun to take advantage of extremely powerful solutions designed to brute force their way into accounts by using software to rapidly guessing thousands of passwords per second, making it extraordinarily difficult to prepare yourself for them.

What’s the best way to guarantee that passwords aren’t going to be the downfall of your company? A great start is by taking a close look at password best practices and two-factor authentication.

Despite what detractors say, regulations are in place for good reason. They typically protect individuals from organizational malfeasance. Many of these regulations are actual laws passed by a governing body and cover the entire spectrum of the issue, not just the data involved. The ones that have data protection regulations written into them mostly deal with the handling and protection of sensitive information. For organizations that work in industries covered by these regulations there are very visible costs that go into compliance. Today, we look at the costs incurred by these organizations as a result of these regulations, and how to ascertain how they affect your business.