Their Claim to Fame – So-Called HIPAA-Compliance Experts and Tools

Have you noticed how many vendors and software solutions are out there claiming they can make you HIPAA-compliant? Well, at the end of the day thats simply not possible because only you can make your organization HIPAA-compliant. I came up with a list of "red flags" that I typically see from...

Apple Pay and PCI Compliance

A year ago, many retail cybersecurity discussions began and ended with PCI compliance. Today, after a gut-wrenching 10 months of data breaches stretching from mom-and-pop shops to category-leading brands, the discussions are broader, the risks are better understood and every link in the customer...

IT Security Horror Story: Is your Network an Unsegmented Haunted House?

One day I went to a client site to perform internal penetration test to emulate the insider threat. This testing was designed to help this client understand the damage a rogue employee or an intruder who gained physical access to the network could do. The site that I was visiting was a storefront...

Keeping your restaurant & hospitality Cardholder Data Environment safe

Reports of new credit card data breaches seem to be in the news daily. Recent high profile breaches within major retailers this year should serve as a wake-up call to the restaurant and hospitality industries. As a result of having high volumes of credit card transactions and decentralized securi...

Embracing the Cloud's Potential for Security

I spoke recently at TIAs Network of the Future conference. At the session, which was heavier on vendors than operators, the discussion was very focused on the cloud. Everyone wants to know whats coming next and if theyre ready for it...

DoD DIACAP transition to RMF approved

Welcome DIARMF! This has been a long time coming. From DITSCAP to DIACAP and now to DIARMF the Department of Defense approved the transition to a Risk Management Framework RMF approach developed by NIST on March 12. What does this mean for Information Systems and Platform Information Technology...

The PCI DSS 3.0 SAQs are here!

The Payment Card Industry Security Standards Council PCI SSC released Data Security Standards DSS 3.0 in November 2013 and has just released the related Self-Assessment Questionnaires SAQ. There are two new SAQs, SAQ A-EP and SAQ B-IP...

A Proven Strategy for Implementing Vendor Management Programs

Every regulated industry includes a requirement for managing third-party risk. Some industries are further along the path and have more mature processes than others. However, there are tried and true methodologies and standards established by those early movers that we can utilize across other...

What every CIO should know about the new ISO 27001:2013 framework

Originally released in 2005, the ISO 27001 standard has recently been updated with additional guidelines for assessing risks within information management systems. These changes constitute the first revisions to the standard in eight years and have major implications for organizational compliance...

College students concerned about information security

Universities and colleges have been under significant pressure to upgrade their technology both in and out of the classroom. For instance, many organizations turn to mobility as a way to engage students and facilitate learning campus-wide. While much of the discussion is around issues such as the...

Highlights of Newly Released PCI DSS 3.0 Information

The standards are coming! The PCI SSC has finally let loose with some much needed information regarding the upcoming releases of the PCI DSS 3.0 and PA DSS 3.0 standards. Available on the PCI SSC website; the document titled "Version 3.0 Change Highlights" contains information on what PCI...

MAPCO Incident Highlights the Risks Faced by All Convenience Stores

On May 6, 2013, convenience store operator MAPCO Express, Inc. did a responsible thing - they issued a press release that shared important information about a data security incident that was discovered at their stores. Such notices ---along with a whole lot of behind-the-scenes investigative work...

All Aboard the HIPAA Omnibus - but is the ‘bus’ missing anything?

In the wake of the recently-released HIPAA Omnibus Rule with its upcoming deadline, healthcare organizations are trying to figure out how theyre going to achieve compliance. Weve been busy trying to get through the 563-page rule and determine what it means to our clients...

The PCI SAQ P2PE-HW: Patience, POIs and PIMs

The new PCI SAQ P2PE-HW Point to Point Encryption Self-Assessment Questionnaire was released in July 2012, and many merchants are excited about the prospect of a shorter, less arduous compliance validation effort. After all, its significantly shorter than the SAQ-D; instead 12 sections, there are...

What's Next in Retail IT? The Convergence of Mobile, P2PE and the Cloud

Greetings from the Javits Center in New York City, the site of the National Retail Federations Big Show. This year, the theme of NRF is "Next". When it comes to Retail technology - and in particular, security and compliance, the most talked about "next" things are:...

VMware releases PCI Solution Guide and it has good news for compliance-oriented buyers

This month VMware release an important document, the VMware Solution Guide for Payment Card Industry PCI. Its significant because it is the first document of its kind to map the PCI requirements - including those authored by the PCI SSCs Virtualization SIG - to a commercially-available stack of...

Data Privacy Day 2012 – BYOD

January marks Data Privacy Month and on January 28th we celebrated Data Privacy Day. In the past year, we have seen an increase in the consumerization of IT and "Bring Your Own Device" BYOD in the enterprise. In honor of Data Privacy Day 2012, we have partnered with The Center for Identity at The...

Coalfire Systems Assessment: Merchant Link’s TransactionShield and TransactionVault Reduce Merchant’s PCI Scope

Merchants spend a lot of time and money developing IT controls programs to protect consumer credit card data. Through our work with thousands of retailers, weve learned that one of the best ways to contain costs and reduce risk is to keep cardholder data out of as many systems and business...

Meeting and scaling compliance with IaC design

Gone are the days when cloud, application, and infrastructure engineers need to shoulder the burden of compliance and audits. With "smart" compliance-aware Infrastructure as Code IaC module design, engineers can focus on the functionality, performance, and scalability of their applications withou...

Understanding compliance platform capabilities: black box automation has its limitations

Compliance is hard. It is not a "black box" of opaque inputs and outputs, where systems and data are hidden and where users are oblivious to their inner workings. There has yet to be a product made that can magically produce all the evidence sufficient for testing and verification across the wide...

StateRAMP: The “easy button” is now a reality

When StateRAMP was announced last year, I was excited! Finally, they have put together a program that will enforce rigorous cloud security standards, while reducing the burden on state and local governments, which are flexible and eliminate repetitive and costly authorization and accreditation...

Getting started with ZAP and the OWASP top 10: common questions

I recently received an email from a developer who was gearing up to use OWASP ZAP to test the security of their code. The developer had some questions about OWASP ZAP, testing for the OWASP Top 10 2013, and ZAP configuration. After I answered the email, I asked if I could repost it here because I...

AppSec Bites: A Podcast on Balancing Speed and Thorough AppSec Coverage (Part 1)

In the world today we have all become so accustomed to high-speed delivery and the instant gratification it instills any large 2-day shipping retail monsters come to mind?. Its only natural that the demand for speed and efficiency we are experiencing in our daily lives has expanded to the...

Systemic non-compliance: the root cause of pain for healthcare organizations

Recently, I was fortunate enough to experience the joys of becoming a father as my wife and I welcomed our first child into the world. It was one of the most beautiful experiences of my life and Im grateful for the advances we have made in modern medicine and technology. I mention this personal...

Applied ThreadFix: Application Portfolio Tracking

Asset management is a serious issue across the information security space. A very common challenge we see for organizations running an application security program is just getting an idea of what applications they have available and what infrastructure has been deployed to support them. You cant...

Managing Vulnerabilities Introduced from Open Source Code Libraries

Modern development architectures are commonly based around open source components. Using open source components helps organizations lower their overall development cost while improving the time to market for new applications. Introducing these components however, can lead to serious consequences...

Applied ThreadFix: Getting the Most Out of Your Training Investment

As we talked about in an earlier blog post, secure coding training for developers can be expensive. Knowledgeable individuals who are adept at training are relatively rare. Quality training materials are expensive to develop and maintain. For these reasons, solid commercial instructor-led trainin...

Applied ThreadFix: Fire Bullets, Then Cannonballs – AppSec Edition

The concept of "firing bullets and then cannonballs" comes from the book Great By Choice by Jim Collins and Morten T. Hansen. The idea works a little like this: first fire your "bullets" - low-cost, low-risk, low-distraction experiments to figure out what will work. This allows you to calibrate...

New News About the HITRUST Scoring Rubric and PRISMA Model

This is a high-level overview of the most significant changes about the updated HITRUST scoring rubric and PRISMA model that will affect all organizations using the HITRUST framework. It contains tips and guidance for how to prepare for upcoming HITRUST assessments. If you need a deeper dive into...

Humans Are the Weakest Link in Security

In our recent analysis of penetration testing engagements contained in our Penetration Risk Report, we discuss the impact that social engineering, specifically phishing, has on the ability to allow attackers insider access to compromise an organization...

A Cyber Engineering Primer: Automated Tools for Compliance Auditing

Cybersecurity practitioners sometimes forget to define and explain the terms we use during the course of our work. Thus, my colleagues and I have embarked on a series of posts that provide a primer on some of the most important cyber engineering practices. In this post, we will focus on...

AICPA Releases New SOC 2 Guide – What You Need to Know

In March 2018, the American Institute of Certified Public Accountants AICPA released its highly anticipated new System and Organization Controls 2 SOC 2 guide, which includes information for the extant 2016 trust services principles and the new 2017 trust services criteria. The following is a...

Cybersecurity Incident Response: Three Lessons from Uber’s Story

The recent news regarding the Uber breach has captured the attention of both the public and legislators. It seems that Ubers security team discovered a breach, paid a ransom, and didnt report the matter to company leaders, law enforcement, personnel, or customers...

How Next-Generation Firewall Platforms Help Protect Your Perimeter at Each Stage of the Cyber Kill Chain*

Whether you need to upgrade your firewalls on-premise or in the cloud, next-generation firewalls NGFWs can significantly reduce the risks associated with the modern threat landscape. Since attacks have evolved using techniques such as encryption, polymorphism, etc., firewalls have also evolved to...

FedRAMP JAB Business Case extended

The FedRAMP Business Case for being considered for this cycle of the Joint Authorization Board JAB has been pushed out to August 31 at 5:00pm eastern. The additional time is to accommodate the large number of requests to document demand verification. Earlier the JAB has stated that federal demand...

SOC 2 Criteria: Change Is Coming - And You Can Have a Voice

SOC 2 reports are an important tool service providers use to give their customers assurances about their services security, compliance, privacy, availability, confidentiality and processing integrity by providing details about the service and the related controls that are in place. SOC 2...

Getting the Most Value Out of Your Phishing Program

Are your phishing tests worth the money you are spending on them? Please dont misinterpret that as suggesting you shouldnt be testing your users. To the contrary, I think you should be testing all your users executives of all ranks included on a regular basis. What I mean by that question is; are...

SSAE No 18 effective for SOC reports dated May 1, 2017

The AICPA Auditing Standards Board ASB announces new changes for SOC reporting under SSAE No. 18 in April 2016. A description of the changes and what it means for service organizations is below. The AICPAs attestation standards contain the requirements and application guidance for performing and...

To [Hell] Shell and Back

My initial thought was it has to be the firewall keeping my reverse shell from getting out of their environment. So, leveraging the command execution vulnerability, I started testing outbound internet access from the vulnerable server to my server on the internet, only to find that the port I had...

One Way to Boost Proactive Cybersecurity

Its clear from media articles that new CISOs need to make an immediate impact on their organizations security program in the first 90 days with action items such as "make a quarterly plan for the next year"...

Coalfire Contributes to New Book on Cybersecurity

Today marks the launch of a new book published by the New York Stock Exchange and Palo Alto Networks called, "Navigating the Digital Age: The Definitive Cybersecurity Guide for Directors and Officers." Im proud to have worked with my predecessor, the late Rick Dakin, to contribute a chapter to th...

DerbyCon is right around the corner (Sept. 23 - 25)

DerbyCon is right around the corner Sept. 23 - 25 and we wanted to highlight two sessions that Coalfire Labs team members will be presenting...

P2PE in Higher Education--Reducing Applicable Controls

Point to Point Encryption P2PE is the hottest topic in the PCI world right now and many of our Higher Education clients are anxious to take advantage of the solutions available to them. However, with 2.0 not yet released, and then the subsequent release of the audit guidelines, there are many...

Final HITECH Act Stage 3 Meaningful Use Rules May Require Annual Risk Analysis plus a Risk Management Component

The comments are in and the HHS is scrambling to review them all before they issue the final Stage 3 Meaningful Use rules later this summer. Comments from entities such as CHIME and HIMSS represent good news and bad news for healthcare providers, depending on how you look at it. The HIPAA Securit...

Big news from the HITRUST 2015 conference: The HITRUST CSF is gaining momentum as the de facto framework amongst healthcare organizations

As the HITRUST 2015 conference in Grapevine, Texas ended, I was reminded of the numerous predictions that flagged 2015 the year of the healthcare breach. And in just the first half of the year weve already witnessed three mega breaches that combined to compromise over 90 million patient records. ...

Chertoff Group Security Series Educates Financial Services Institutions about Cybercrime

Last week I attended The Chertoff Groups Security Series on Building Resiliency for Financial Services Sector. They provided insight into what theyre doing to protect their organizations, how they see the industry evolving, and firsthand knowledge about emerging threats...

Secret Services Issues Warning to Hospitality Industry, Now What?

The U.S. Secret Service has issued an advisory to the hospitality industry to be on alert for keyloggers on the computers in the business center. Whether your hotel received this advice or not, this is something that will undoubtedly affect your business in the near future. Weve put together this...

What are Insurers really covering?

Across the country, executives and their boards saw the data breaches that occurred at large, well-run retailers and immediately began asking the right questions about their own systems and protections. The challenge for the insurance industry is that the plan for many of these companies seems to...

Heartbleed – When Will the Next Shoe Drop?

Last week, while I was in the offices of one of our customers, a long-present but little-known vulnerability in OpenSSL became public knowledge. Our client detected it early and made the necessary patches and updates. The systems deployed by their customers are now secure. Consumers will change...

Heartbleed Vulnerability Bug: What You Need to Know

The widely publicized heartbleed bug http://heartbleed.com/ may be impacting as many as 500,000 systems across the Internet. Heartbleed is the name of a vulnerability in the OpenSSL program that powers encrypted communication to many of the worlds web sites and private networks. Below you will fi...