Success of Our vCISO Program in a Credit Union Client

Our vCISO program recently celebrated a significant success with one of our credit union clients, demonstrating the profound impact of our tailored security strategies and expert guidance.

From the onset, we approached the partnership with a comprehensive risk assessment, focusing on the unique needs and regulatory requirements of the credit union sector. Leveraging our deep understanding of financial services and compliance, we crafted a robust security roadmap aligned with the NCUA ISE and CIS CSC guidelines. This foundational work set the stage for a series of strategic implementations and continuous improvements.

Key Components of Our Success

A key component of our success was the execution of tailored table-top exercises, as outlined in our proprietary workflow. These exercises simulated various incident scenarios, enabling the credit union’s team to refine their incident response protocols and improve their readiness for potential cyber threats. Our iterative approach ensured that the scenarios were realistic and relevant, leading to significant enhancements in their incident management capabilities.

Moreover, our ongoing advisory services included regular reviews and updates to their security policies and procedures, ensuring alignment with best practices and regulatory standards. This proactive stance not only fortified their security posture but also provided assurance to their stakeholders about the integrity of their financial processes.

We also prioritized the implementation of advanced threat detection and response mechanisms. Utilizing our HoneyPoint™ Security Server, the credit union achieved real-time threat intelligence and a deeper understanding of their network security landscape. This capability was crucial in detecting and mitigating threats before they could escalate into significant incidents.

One of the standout achievements was the credit union’s enhanced resilience against ransomware attacks, a prevalent threat in the financial sector. Our detailed ransomware preparedness checklist guided their implementation of critical controls, from regular data backups to comprehensive user education on phishing risks. This multi-layered defense strategy significantly reduced their vulnerability to such attacks.

Conclusion

The success of this engagement underscores the value of our vCISO program. By combining strategic oversight, hands-on exercises, and continuous improvement initiatives, we enabled our credit union client to not only meet but exceed their security and compliance objectives. This partnership exemplifies our commitment to empowering clients with the tools and knowledge necessary to navigate the complex cybersecurity landscape effectively.

To learn more about how our vCISO program can transform your organization’s security posture, visit our blog at stateofsecurity.com or contact MicroSolved directly. Together, we can build a more secure future.

 

* AI tools were used as a research assistant for this content.

Interview on MachineTruth Global Configuration Assessments

Recently, Brent Huston, our CEO and Security Evangelist, was interviewed about MachineTruth™ Global Configuration Assessments and the platform in general. Here is part of that interview:

Q1: Could you explain what MachineTruth Global Configuration Assessments are and their importance in cybersecurity?

Brent: MachineTruth Global Configuration Assessments are part of a broader approach to enhancing cybersecurity through in-depth analysis and management of network configurations. They involve the passive, zero-deployment offline analysis of configuration files to model logical network architectures, changes, segmentation options, and trust/authentication patterns and provide hardening guidance. This process is crucial for identifying vulnerabilities within a network’s configuration that could be exploited by cyber threats, thus playing a pivotal role in strengthening an organization’s overall security posture.

Q2: How does the MachineTruth approach differ from traditional network security assessments?

Brent: MachineTruth takes a unique approach by focusing on passive analysis, meaning it doesn’t interfere with the network’s normal operations or pose additional risks during the assessment. Unlike traditional assessments that may require active scanning and potentially disrupt network activities, MachineTruth leverages existing configuration files and network data, minimizing operational disruptions. This methodology allows for a comprehensive understanding of the network’s current state without introducing the potential for network issues during the assessment process.

It also allows us to perform holistic assessments and mitigations across networks that can be as large as global in scale. You can ensure that standards, vulnerability mitigations, and misconfiguration issues are managed on every relevant device and application across the network, cloud infrastructure, and other exposures simultaneously. Since you get back reporting that includes root cause analysis, your executive and management team can use that data to fund projects, purchase tools, or increase vigilance. The technical details have identified issues and detailed mitigations for every single issue, allowing you to rapidly prioritize, distribute, and mitigate any shortcomings in the environment. Overall, clients find it a uniquely powerful tool to harden their security posture, regardless of the size and complexity of their network architectures.

Q3: In what way do Global Configuration Assessments contribute to an organization’s risk management efforts?

Brent: Global Configuration Assessments contribute significantly to risk management by providing detailed insights into the network’s configuration and architecture. This information enables organizations to identify misconfigurations, unnecessary services, and other vulnerabilities that could be leveraged by attackers. By addressing these issues, organizations can reduce their attack surface and mitigate risks associated with cyber threats, enhancing their overall risk management strategy.

Q4: Can MachineTruth Global Configuration Assessments be integrated into an existing security framework or compliance requirements?

Brent: MachineTruth Global Configuration Assessments can seamlessly integrate into security frameworks and compliance requirements such as ISO 27001, PCI DSS, NERC CIP, HIPAA, CIS CSC, etc. The insights and recommendations derived from these assessments can support compliance with various standards and regulations by ensuring that network configurations align with best practices for data protection and cybersecurity. This integration not only helps organizations maintain compliance but also strengthens their security measures in alignment with industry standards.

Q5: What is the future direction for MachineTruth in the evolving cybersecurity landscape?

Brent: The future direction for MachineTruth in the cybersecurity landscape involves continuous innovation and adaptation to address emerging threats and technological advancements. As networks become more complex and cyber threats more sophisticated, MachineTruth will evolve to offer more advanced analytics, AI-driven insights, and integration with cutting-edge security technologies. This ongoing development will ensure that MachineTruth remains at the forefront of cybersecurity, providing organizations with the tools they need to protect their networks in an ever-changing digital environment. MachineTruth has been in constant development and leveraged to perform security services for more than six years to date, and we feel confident that we are just getting started!

To learn more about MachineTruth, configuration assessments or the various compliance capabilities of MSI, just drop us a line to info@microsolved.com. We look forward to working with you!

Securing Patient Data: The Essential Role of Firewall and Router Reviews in HIPAA Compliance

Firewall and router configuration reviews are pivotal in maintaining HIPAA compliance, safeguarding sensitive healthcare information from unauthorized access and potential cyber threats. Regular assessments of network infrastructure help organizations identify vulnerabilities, ensuring the confidentiality, integrity, and availability of patient data. In this realm, leveraging advanced solutions like MachineTruth™ Global Configuration Assessment can significantly streamline and enhance this process.

MTFirewallDC

 

 

 

 

 

MachineTruth, developed by MSI, employs proprietary analytics and machine learning to review device and application configurations on a global scale. It compares device configurations against industry-standard best practices, known vulnerabilities, and common misconfigurations, allowing for a comprehensive assessment of an organization’s network security posture. This methodology ensures not just the identification of potential security gaps but also promotes control homogeneity across the enterprise, a critical factor in adhering to HIPAA’s stringent requirements.

The process begins with the collection of textual configurations from relevant devices, which can be facilitated by MSI’s secure file transfer methods. Utilizing tools and the assistance of partners can make this step a breeze, eliminating the complexities often associated with gathering and preparing data for analysis. The configurations then undergo rigorous analysis via the MachineTruth platform, alongside manual reviews by security engineers. This dual-layered approach ensures a thorough assessment, highlighting significant issues or evidence of compromise. The outcome is a detailed report comprising executive summaries, technical findings, and actionable mitigation strategies for identified vulnerabilities and configuration findings.

For healthcare organizations, incorporating MachineTruth into their security assessment protocols not only aids in HIPAA compliance but also significantly enhances their overall security posture. By identifying and mitigating risks proactively, these entities can safeguard patient privacy more effectively while avoiding the severe penalties associated with non-compliance.

In conclusion, firewall and router configuration reviews are indispensable for HIPAA compliance. Incorporating MachineTruth Global Configuration Assessment into these reviews can offer organizations a comprehensive, scalable solution to enhance their security measures. For those interested in leveraging this cutting-edge technology to fortify their network security and ensure compliance, reaching out to MSI at info@microsolved.com is the next step. Engage with MSI today and ensure your organization’s network infrastructure is not only compliant with HIPAA regulations but is also secure against evolving cyber threats.

 

* AI tools were used in the research and creation of this content.

Meeting PCI-DSS 1.1.7 with MachineTruth Global Configuration Assessments

Explanation of PCI-DSS requirement 1.1.7

The process for reviewing firewall, router, and network device configurations and rule sets every six months involves several steps to ensure compliance with PCI DSS Requirement 1.1.7 and maintain network security controls and router configuration standards.

Organizations can effectively conduct these reviews by utilizing services such as MachineTruth™ Global Configuration Assessments to analyze the configuration settings of firewalls, switches, routers, applications, and other network devices. By conducting regular audits and involving key personnel from the IT and security teams in the review of the results, organizations can ensure that their network device configurations and rule sets comply with PCI DSS Requirement 1.1.7 and maintain strong network security controls.

FirewallDC

Conequences for failing to meet PCI-DSS 1.1.7

Compliance with PCI-DSS is crucial for maintaining the security and integrity of sensitive payment card information. Failing to meet the requirements of PCI-DSS can have significant implications for a company, including legal and financial consequences.

One specific requirement of PCI-DSS is 1.1.7, which addresses the need to test security systems and processes regularly. Failing to comply with this specific requirement can result in severe penalties, including hefty fines and potential legal action. Companies may also face damage to their reputation and loss of customer trust. In some cases, non-compliance with PCI-DSS requirements may lead to the inability to process payment card transactions, causing significant operational disruptions. Ultimately, the consequences of failing to meet PCI-DSS 1.1.7 can have far-reaching impacts on a company’s bottom line and long-term viability. Therefore, businesses must prioritize and invest in maintaining compliance with PCI-DSS to avoid these detrimental consequences.

Importance of securing inbound traffic

Securing inbound traffic is critical for maintaining the cardholder data environment’s security and integrity, as PCI DSS Requirement 1.2.1 mandates. Organizations can effectively prevent unauthorized access and potential security breaches by limiting inbound and outbound traffic to only what is necessary for the cardholder data environment. Traffic restrictions are crucial in controlling and monitoring data flow into the network, ensuring that only authorized and necessary sources and protocols are allowed entry. This helps to minimize the risk of unauthorized access and potential security breaches, as any unnecessary or unauthorized traffic is blocked from entering the network. By implementing and enforcing these traffic restrictions, organizations can significantly reduce the likelihood of data breaches and maintain compliance with PCI DSS standards. Therefore, organizations must prioritize and effectively secure their inbound traffic to safeguard their cardholder data environment.

Importance of securing outbound traffic

Securing outbound traffic is paramount for protecting an organization’s sensitive information and preventing potential risks such as data breaches, exposure to malware, and unauthorized access to critical data. Unsecured outbound traffic can lead to data leaks, theft of intellectual property, and compromise of confidential information, causing significant financial and reputational damage to the organization.

Implementing egress filtering, encryption, data loss prevention, and threat detection measures can help mitigate and/or minimize these risks. Egress filtering is the single most powerful tool in preventing data exfiltration. By implementing best practices around all network traffic leaving the network or segments, most data exfiltration can be disrupted. Encryption ensures that data transmitted outside the organization’s network is securely ciphered, preventing unauthorized access and data breaches. Data loss prevention tools enable organizations to monitor and control the transfer of sensitive data, thereby reducing the risk of data leaks and unauthorized access. In addition, threat detection methods allow real-time visibility into outbound traffic, enabling prompt detection and response to unauthorized or malicious activities.

By securing outbound traffic through these measures, organizations can significantly reduce the likelihood of data breaches, exposure to malware, and unauthorized access to sensitive information, thus safeguarding their critical assets and maintaining the trust of the card brands and customers.

Description of MachineTruth Global Configuration Assessment capabilities

This assessment leverages MicroSolved’s proprietary analytics and machine learning platform, MachineTruth, to review device and application configurations in mass at a global scale. The assessment compares device configurations against industry standard best practices, known vulnerabilities, and common misconfigurations. It also allows organizations to ensure control homogeny across the enterprise, regardless of using different vendors, products, and versions.

Adopted security standards and security policies can be used as a baseline, and configurations can be compared holistically and globally against these universal security settings. Compensating controls can be identified and cataloged as a part of the assessment if desired.

Various analytics can also be performed as a part of the review, including trusted host hierarchies, reputational analysis of various sources for configured rules and access control lists, flagging of insecure services, identification of deprecated firmware, log management settings, protocols, encryption mechanisms, etc. MachineTruth can hunt down, flag, and provide specific mitigation and configuration advice to ensure these issues are fixed across the enterprise, architectures, and various vendor products.

If needed, the MachineTruth platform can verify network segmentation and serve as proof of these implementations to reduce the compliance scope to a subset of the network and data flows.

How MachineTruth helps organizations meet PCI requirements

MachineTruth Global Configuration Assessments help organizations simplify the process of meeting PCI-DSS 1.1.7 and other relevant regulatory requirements. By working across vendor platforms, and reviewing up to several thousand device configurations simultaneously, even the most complex networks can be reviewed holistically and quickly. Work that would have taken several man-years to perform with traditional methods can be accomplished quickly and with a minimum of resources.

Multi-level reporting also provides for an easy, prioritized path to mitigation of the assessments, and if you need assistance, MicroSolved’s extensive partner network stands ready to help you make the changes across the planet. The output of the assessment includes technical details with mitigations for each finding, a technical manager report with root causes, and suggestions for improvement across the enterprise, as well as an executive summary report that is designed to help upper-level management, boards of directors, auditors, and even business partners performing due diligence, understand the assessment outcome and the state of security throughout the organization’s networks. The reporting is excellent for establishing the true state of network compliance, even on a global scale.

This not only allows organizations to easily and rapidly meet PCI-DSS 1.1.7, but also allows them to quickly harden their networks and increase their security posture at a rate that was nearly impossible in the past. Leveraging the power of AI, machine learning, and analytics, even the most complex organizations can make solving this compliance problem easy.

How to Engage with MicroSolved, Inc.

To learn more about a MachineTruth Global Configuration Assessment or the 30+ years of security expertise of MicroSolved, Inc., just drop us a line at info@microsolved.com. You can also reach us at +1.614.351.1237. Our team of experts will be more than happy to walk through how the platform works and discuss the workflow and costs involved with this unique option for meeting PCI requirements and other relevant regulatory guidance. While MicroSolved is a small firm with more than 30 years in business, some clients prefer to work through our larger partners who are likely already on established vendor lists. This is also possible, and the protocols and contractual arrangements are already in place with a number of globally recognized professional services firms. Whether you choose to work with MicroSolved directly, or through our partner network, you will receive the same excellent service, leading-edge insights and benefit from our proprietary MachineTruth platform.

Navigating the Regulatory Terrain: Firewall Rule and Configuration Reviews

In the ever-evolving landscape of network security, the significance of firewall rules and configuration reviews stands paramount. For organizations, navigating through the complex web of industry standards and regulations is not just a matter of compliance but a cornerstone in safeguarding sensitive data and fortifying defenses against cyber threats. This discourse aims to demystify the regulatory frameworks governing firewall configurations, highlighting their pivotal role in sculpting a resilient network infrastructure.

The Imperative of Regulatory Adherence:

Navigating the labyrinth of regulations like PCI DSS (Payment Card Industry Data Security Standard) and HIPAA (Health Insurance Portability and Accountability Act) is more than a compliance checkbox. It’s an integral strategy to thwart unauthorized access, data breaches, and other security loopholes. A meticulous alignment with these standards underpins your organization’s commitment to unwavering security and data protection.

  • PCI DSS Compliance: Regular firewall configuration reviews ensure alignment with PCI DSS mandates. These reviews should encompass comprehensive documentation and alert mechanisms to adhere to the security management controls and firewall rule examination requirements.
  • HIPAA Conformity: For organizations handling healthcare data, firewall configuration reviews are instrumental in aligning with HIPAA’s stringent requirements, ensuring the safeguarding of sensitive patient data.

International Standards: Aligning with ISO 27001

Embracing global benchmarks like ISO 27001 requires an exhaustive evaluation of firewall configurations. This process entails benchmarking current configurations against ISO standards and rectifying any discrepancies to achieve compliance. Key focus areas include access control, network segmentation, and adherence to security policies.

Understanding Firewall Configuration Reviews: A Deep Dive

The essence of firewall configuration reviews lies in scrutinizing settings, rules, and protocols to uncover vulnerabilities and threats. This thorough analysis enables IT professionals to bolster the firewall’s defense capabilities, enhancing the overall security fabric of the network.

Purpose and Benefits of Routine Firewall Configuration Reviews:

  • Risk Mitigation: Regular reviews unveil security vulnerabilities and compliance deviations, essential in maintaining a fortified network environment.
  • Optimizing Resources: Eliminating outdated or redundant rules enhances network efficiency and performance.
  • Compliance Assurance: These reviews are pivotal in meeting regulatory standards, averting fines, and sustaining a robust security posture.
  • Cost Savings: Proactive reviews and updates curtail the likelihood of breaches and associated financial repercussions.

Defining Firewall Configuration Review:

A firewall configuration review is a meticulous examination of firewall settings and rules. It’s aimed at ensuring optimal protection against unauthorized access and cyber threats. This process identifies potential security gaps and ensures adherence to best security practices.

Partner with MicroSolved for Expert Firewall Configuration and Analysis

At MicroSolved, we recognize the complexities and critical nature of firewall configuration reviews. Our MachineTruth™ service offers unparalleled expertise in firewall configuration and analysis, scalable to global operations. Our team of experts employs advanced methodologies, proprietary machine learning, analytics and custom-built private AI to ensure your firewall configurations are not only compliant with the latest regulations but also optimized for peak performance and security. Since we can analyze all of your firewalls, routers, switches and other network devices simultaneously, we can also ensure that your security posture is consistent everywhere you have a presence!

Embark on your journey towards a more secure and compliant network infrastructure with MicroSolved. Contact us today (info@microsolved.com or +1-614-351-1237) to learn more about our MachineTruth™ services and how we can tailor them to meet your organization’s unique needs.

 

* Just to let you know, we used some AI tools to gather the information for this article, and we polished it up with Grammarly to make sure it reads just right!

 

Maximize Your Cybersecurity: Discover How a Virtual CISO Can Transform Your Business Security Strategy

What is a vCISO?

A vCISO, virtual CISO, or virtual Chief Information Security Officer is a highly qualified cybersecurity expert who provides IT security and compliance services on a contractual basis. Unlike a full-time CISO, a vCISO works remotely and collaborates with an organization’s executive team to protect against security threats and ensure compliance with industry regulations.

As a cybersecurity expert, a vCISO brings years of experience and a wide range of skills. They deeply understand security practices, threat landscapes, and industry standards. With this knowledge, they can assess an organization’s security posture, identify potential gaps and risks, and develop a comprehensive cybersecurity strategy.

A vCISO’s role is to provide unbiased advice and guidance to the organization’s leadership team. They work closely with the executive team to align security objectives with business goals. VCISOs can help establish and implement security policies, compliance standards, and best practices by leveraging their technical expertise and industry knowledge.

By hiring a vCISO on a contractual basis, organizations gain access to a team of experts without the commitment of a full-time hire. This flexible and cost-effective approach allows businesses to benefit from the expertise of a seasoned professional while optimizing their security program. Ultimately, a vCISO helps organizations enhance their security posture and proactively mitigate cyber threats.

What does a virtual Chief Information Security Officer do?

A virtual Chief Information Security Officer (vCISO) plays a critical role in assisting organizations in developing and managing their information security program. One of the primary responsibilities of a vCISO is to create and implement a comprehensive security strategy for the organization. This includes identifying and prioritizing security threats, developing security policies and procedures, and establishing security controls to mitigate risks.

In addition to creating the security strategy, a vCISO coordinates and manages security audits conducted within the organization. They work closely with internal and external auditors to ensure the organization’s security practices and controls meet regulatory requirements and industry standards. This involves conducting risk assessments, reviewing security controls, and implementing necessary changes to enhance the organization’s security posture.

Furthermore, a vCISO evaluates third-party vendors and assesses their security capabilities. They ensure that third parties comply with the organization’s security requirements and implement necessary security measures to protect its data and systems from potential risks.

A crucial part of a vCISO’s role is presenting the organization’s security posture to stakeholders, such as the executive team and board members. They regularly update the organization’s security posture, including identified vulnerabilities or emerging threats. This helps stakeholders make informed decisions regarding the organization’s security investments and priorities.

A vCISO plays a vital role in helping organizations build a robust and effective information security program by fulfilling these responsibilities. They bring their expertise to develop a comprehensive security strategy, coordinate audits, evaluate third parties, and present the organization’s security posture to stakeholders.

Learning More

In conclusion, navigating the complex cybersecurity landscape can be daunting for any organization. However, partnering with a seasoned virtual Chief Information Security Officer (vCISO) can significantly enhance your security posture and ensure compliance with the latest industry standards. This is where MicroSolved comes into play. With our extensive experience and deep expertise in cybersecurity, we offer tailored vCISO services designed to meet your unique needs and challenges. Let us help you fortify your defenses, mitigate risks, and secure your digital assets effectively. Don’t wait for a security breach to realize the importance of expert guidance. Contact MicroSolved today and take a proactive step towards a more secure and resilient future.

 

* Just to let you know, we used some AI tools to gather the information for this article, and we polished it up with Grammarly to make sure it reads just right!

Utility Tabletop Cybersecurity Exercises

Recently, a group of federal partners, comprised of the Federal Energy Regulatory Commission (FERC), North American Reliability Corporation (NERC) and it’s regional entities released their Cyber Planning for Response and Recovery Study (CYPRES). The report was based on a review and analysis of the incident response and recovery capabilities of a set of their member’s cyber security units, and is a great example of some of the information sharing that is increasing in the industry. The report included reviews of eight utility companies’ incident response plans for critical infrastructure environments, and the programs reviewed varied in their size, complexity and maturity, though all were public utilities.

Though the specific tactics suggested in the report’s findings have come under fire and criticism, a few items emerged that were of broad agreement. The first is that most successful programs are based on NIST 800-61, which is a fantastic framework for incident response plans. Secondly, the report discusses how useful tabletop exercises are for practicing responses to cybersecurity threats and re-enforcing the lessons learned feedback loop to improve capabilities. As a result, each public utility should strongly consider implementing periodic tabletop exercises as a part of their cyber security and risk management programs.

Tabletop Exercises from MSI

At MicroSolved, we have been running cyber security tabletop exercises for our clients for more than a decade. We have a proprietary methodology for building out the role playing scenarios and using real-world threat intelligence and results from the client’s vulnerability management tools in the simulation. Our scenarios are developed into simulation modules, pre-approved by the client, and also include a variety of randomized events and nuances to more precisely simulate real life. During the tabletop exercise, we also leverage a custom written gaming management system to handle all event details, track game time and handle the randomization nuances.

Our tabletop exercise process is performed by two MSI team members. The first acts as the simulation moderator and “game master”, presenting the scenarios and tracking the various open threads as the simulation progresses. The second team member is an “observer” and they are skilled risk management team members who pre-review your incident response policies, procedures and documentation so that they can then prepare a gap analysis after the simulation. The gap analysis compares your performance during the game to the process and procedure requirements described and notes any differences, weaknesses or suggestions for improvement.

Target scenarios can be created to test any division of the organization, wide scale attacks or deeply nuanced compromises of specific lines of business. Various utility systems can be impacted in the simulation, including business networks, payment processing, EDI/supply chain, metering/AMI/smart grid, ICS/SCADA or other mission critical systems.Combination and cascading failures, disaster recovery and business continuity can also be modeled. In short, just about any cyber risks can be a part of the exercise.

Tabletop Exercise Outcomes and Deliverables

Our tabletop exercises result in a variety of detailed reports and a knowledge transfer session, if desired. The reports include the results of the policy/procedure review and gap analysis, a description of the simulated incident and an action plan for future improvements. If desired, a board level executive summary can also be included, suitable for presentation to boards, management teams, direct oversight groups, Public Utility Commission and Homeland Security auditors as well.

These reports will discuss the security measures tested, and provide advice on proactive controls that can be implemented, enhanced, matured or practiced in order to display capabilities in future incidents that reflect the ability to perform more rapid and efficient recovery.

The knowledge transfer session is your team’s chance to ask questions about the process, learn more about the gaps observed in their performance and discuss the lessons learned, suggestions and controls that call for improvement. Of course the session can include discussions of related initiatives and provide for contact information exchange with our team members, in the event that they can assist your team in the future. The knowledge transfer session can also be performed after your team has a chance to perform a major review of the reports and findings.

How to Get Started on Tabletop Exercises from MSI

Tabletop exercises are available from our team for cyber security incidents, disaster preparedness and response or business continuity functions. Exercises are available on an ad-hoc, 1 year, 2 year or 3 year subscription packages with frequencies ranging from quarterly to twice per year or yearly. Our team’s experience is applicable to all utility cyber programs and can include any required government partners, government agencies or regulators as appropriate.

Our team can help develop the scope of threats, cyber attacks or emergency events to be simulated. Common current examples include ransomware, phishing-based account compromises, cyber attacks that coincide with catastrophic events or service disruptions, physical attacks against substations or natural gas pipelines, data breach and compromise of various parts of the ICS/SCADA infrastructure. Our team will work with you to ensure that the scenario meets all of your important points and concerns.

Once the scenario is approved, we will schedule the simulation (which can be easily performed via web-conference to reduce travel costs and facilitate easy team attendance) and build the nuances to create the effects of a real event. Once completed, the reporting and knowledge transfer sessions can follow each instance.

Tabletop exercises can go a long way to increasing cybersecurity preparedness and re-enforcing the cybersecurity mindset of your team. It can also be a great opportunity for increasing IT/OT cooperation and strengthening relationships between those team members.

To get started, simply contact us via this web form or give us a call at (614) 351-1237. We would love to discuss tabletop exercises with you and help you leverage them to increase your security posture.

 

Closing the CUSO Security Loop Hole

The CUSO Security Loop Hole

The NCUA Inspector General (IG) suggested this week that the agency have regulatory oversight of Credit Union Service Organizations (CUSOs) to reduce the overall risk to the system. CUSOs have long been seen as a separate firm from the credit unions, though they may have an ownership stake in them. To date, many of these organizations have been outside the regulatory and oversight controls that are applied to the very credit unions they serve. In terms of information security, that often means they aren’t held to the same level of security and risk management controls as required by NCUA 748 and other guidance.

DigitalMoneyCUSO Security Oversight Challenges

The NCUA IG suggests that NCUA guidance and regulatory oversight be directly applied to CUSOs, instead of through vendor or partner risk management programs of the CUSO customers. This would provide for more direct regulation of the security controls and risk management processes in use at the CUSOs themselves. However, this introduces several challenges for some CUSOs, who may be more focused on agility, market speeds and innovation – areas where regulatory guidance can be especially impactful and can create significant budgetary challenges. This gets even more complicated when regulatory guidance is vague, or can be inflexible – the very opposite of the needs of organizations focused on innovation and market speed adaptation. An excellent example of this is CUSOs working on financial technologies, crypto currencies, blockchain and other exciting new areas. Regulatory guidance lags or lacks in most of those areas and hasn’t caught up to these new, and in some cases, experimental technologies.

One Approach – Best Practices CUSO Security and Third Party Attestation

One approach that might work, is for CUSOs to work with independent third-party assessors who could then measure the CUSO against industry standard best practices that apply to their specific lines of business, research or innovation. These vendors could then help the CUSO build a relevant and respectable CUSO security and risk management program – which they could attest to the NCUA. If this attestation were required on a yearly basis, along with some basic guidance, like ongoing risk management reviews, ongoing vulnerability management, etc – this could go a long way to mitigating the risks that concern the NCUA IG, while still maintaining independence and control by the CUSOs – thus, empowering their mission. Programs like these have been very successful in other industries and don’t have to add the overhead and bureaucracy of full regulatory compliance or programs like PCI-DSS. 

If you’d like to build such a program for your CUSO, please get in touch with us. We’d love to work on creating this process with a handful of CUSOs around the US, and are more than capable of applying our 30 years of experience in information security to each organization’s independent needs. Drop us a line or give us a call at (614) 351-1237 and let’s work together to close the CUSO Security loop hole in a way that reduces risk but doesn’t destroy the power and flexibility of the CUSO ecosystem.

A Quick Expert Conversation About Gap Assessment

Gap Assessment Interview with John Davis

What follows is a quick interview session with John Davis, who leads the risk assessment/policy/process team at MicroSolved. We completed the interview in January of 2020, and below are the relevant parts of our conversation.

Brent Huston: “Thanks for joining me today, John. Let’s start with what a gap assessment is in terms of HIPAA or other regulatory guidance.”

John Davis: “Thanks for the chance to talk about gap assessment. I have run into several HIPAA concerns such as hospitals and health systems who do HIPAA gap analysis / gap assessment in lieu of HIPAA risk assessment. Admittedly, gap assessment is the bulk of risk assessment, however, a gap assessment does not go to the point of assigning a risk rating to the gaps found. It also doesn’t go to the extent of addressing other risks to PHI that aren’t covered in HIPAA/HITECH guidance.”

BH: “So, in some ways, the gap assessment is more of an exploratory exercise – certainly providing guidance on existing gaps, but faster and more affordable than a full risk assessment? Like the 80/20 approach to a risk assessment?”

John Davis: “I suppose so, yes. The price is likely less than a full blown risk assessment, given that there is less analysis and reporting work for the assessment team. It’s also a bit faster of an engagement, since the deep details of performing risk analysis aren’t a part of it.”

BH: “Should folks interested in a gap assessment consider adding any technical components to the work plan? Does that combination ever occur?”

JD: “I can envision a gap assessment that also includes vulnerability assessment of their networks / applications. Don’t get me wrong, I think there is immense value in this approach. I think that to be more effective, you can always add a vulnerability assessment to gauge how well the policies and processes they have in place are working in the context of the day-to-day real-world operations.”

BH: “Can you tie this back up with what a full risk assessment contains, in addition to the gap assessment portion of the work plan?”

JD: “Sure! Real risk assessment includes controls and vulnerability analysis as regular parts of the engagement. But more than that, a complete risk assessment also examines threats and possibilities of occurrence. So, in addition to the statement of the gaps and a roadmap for improvement, you also get a much more significant and accurate view of the data you need to prioritize and scope many of the changes and control improvements needed. In my mind, it also gets you a much greater view of potential issues and threats against PHI than what may be directly referenced in the guidance.” 

BH: “Thanks for clarifying that, John. As always, we appreciate your expert insights and experience.”

JD: “Anytime, always happy to help.”

If you’d like to learn more about a gap assessment, vulnerability assessment or a full blown risk assessment against HIPAA, HITECH or any other regulatory guidance or framework, please just give us a call at (614) 351-1237 or you can click here to contact us via a webform. We look forward to hearing from you. Get in touch today! 

MicroSolved vCISO for Credit Unions

I recently asked MicroSolved COO, Dave Rose, to share his thoughts with all of us about the vCISO program. He has been leading the effort this last year across several credit unions and regional banks around the US. I asked him for the 3 biggest benefits an organization can expect and here is what he said:

“MicroSolved has been providing vCISO services to Credit Unions for over 20 years. Whether you are a corporate or a natural person CU, hiring MSI for vCISO Services will allow you to:

  • Obtain CISO expertise without having to incur the expense of finding and hiring a CISO. This is an affordable solution that will help keep the risk budget under control.
  • MSI vCISO program comes with the benefit of a focus towards financial expertise and compliance. MSI has had extensive experience working with banks and credit unions on their risk programs, and have spent time educating regulators on risk events and controls.
  • MSI is in the business of mitigating risk. We live it everyday and our clients benefit from that experience. Our clients get to pick the risk work they want resolved and the issues they want remediated. 

You will be hard pressed to find a more efficient and cost effective way to address risk issues and move the regulatory needle. Don’t bear the burden of mitigating risk alone, let MSI be a partner to help you solve your risk needs!”

—Dave Rose

For more information, give us a call at 614-351-1237 or email us at info@microsolved.com.