Highlights from the HITRUST Health Industry Third Party Assurance Summit

On June 29, 2015, the Health Information Trust Alliance HITRUST announced that several massive payer organizations, including Anthem, Health Care Services Corp., Highmark, Humana, and UnitedHealth Group will require their business associates to obtain CSF certification. While this is old news,...

Guest blog: PCI audits and how to recognize a good QSA auditor and partner

Many organizations approach a PCI audit with fear and trepidation. There are a lot of stories out there about how difficult, expensive and disruptive a PCI audit can be, but I want to see if I can add some balance to this view. I believe that when it comes to a PCI auditor it matters a great deal...

P2PE in Higher Education--Reducing Applicable Controls

Point to Point Encryption P2PE is the hottest topic in the PCI world right now and many of our Higher Education clients are anxious to take advantage of the solutions available to them. However, with 2.0 not yet released, and then the subsequent release of the audit guidelines, there are many...

Final HITECH Act Stage 3 Meaningful Use Rules May Require Annual Risk Analysis plus a Risk Management Component

The comments are in and the HHS is scrambling to review them all before they issue the final Stage 3 Meaningful Use rules later this summer. Comments from entities such as CHIME and HIMSS represent good news and bad news for healthcare providers, depending on how you look at it. The HIPAA Securit...

Big news from the HITRUST 2015 conference: The HITRUST CSF is gaining momentum as the de facto framework amongst healthcare organizations

As the HITRUST 2015 conference in Grapevine, Texas ended, I was reminded of the numerous predictions that flagged 2015 the year of the healthcare breach. And in just the first half of the year weve already witnessed three mega breaches that combined to compromise over 90 million patient records. ...

Evolving Financial Services Security Requirements: Part 1

Through the end of the year, the New York State Department of Financial Services NYSDFS, or DFS for short, expects to proceed with a number of initiatives to help strengthen cybersecurity at its regulated companies. Among these changes will be integration of regular, targeted assessments of...

Upcoming Podcast: Python security projects

Join Coalfire penetration tester Dan McInerney on Thursday April 30th at 6:00pm ET on the Security Weekly Podcast...

Top 10 Cybersecurity Predictions for 2015

Fueled by cybercrime, cyber warfare, and cyber terrorism, the cost of cybersecurity and risk management will double in 2015. Thats the bad news. The good news is there will be a shift to cyber offense that will begin to stem the tide of cyber threats...

A New Cold War – with Many Sides

A New Cold War - with Many Sides Theres a lot we still dont know about the FBIs investigation of the data theft at JP Morgan Chase & Co. Criminal hackers based in Russia were targeting U.S. financial institutions long before Russia annexed Crimea or the West responded with sanctions. Is this trul...

Please make sure you have offline backups

This ransomware has hit not only personal computers, but also organizations, including a town in New Hampshire. This particular attack was carried out when an employee opened a seemingly legitimate email attachment, once again reminding us of the ever-present danger of social engineering...

Compliance Talk: Debt Collectors and PCI

As the largest IT audit and compliance advisor in the U.S., Coalfire is exposed to a wide variety of compliance concerns. In this series of Compliance Talk blogs, Dirk and Ken are back at their favorite coffee shop…the Bean and Berry in Louisville, Colorado. Over a couple cappuccinos, their...

Getting Your Databases Audit Ready

Your database is perhaps one of the most sensitive targets for cybercriminals as they are your companys primary repository for confidential and proprietary data. Besides knowing what vulnerabilities exist for your perimeter network and also for your internal systems, best practices require you to...

Creative Ideas for Replacing Passwords

Passwords have been the de facto manner of providing security for IT systems. Theyve got a bad reputation, but its not the passwords themselves that deserve the reputation - its the individuals using them and the weak standards to which these passwords are managed. In fact, a password system...

White House Executive Order on Cyber Security

The tense standoff between an unresponsive Congress and a reluctant critical infrastructure industry has been broken. On February 13, 2013, the President issued an Executive Order that provides initial guidance for the country to confront escalating cyber threats. Finally, we have someone with th...

Long-awaited HIPAA Omnibus Rule is Unveiled

As of January 17, 2013, the HIPAA Omnibus Rule has finally been released by the Department of Health and Human Services HHS, which will modify the HIPAA privacy, security, and enforcement rules. The package of regulations, in regard to this long-overdue HIPAA Omnibus Rule, will officially be post...

Small Breach, Big Settlement

Earlier this week the Department of Health and Human Services HHS announced the first ever breach settlement where fewer than 500 patient records were compromised. The $50,000 settlement was issued as a result of 441 patient records being stored on an unencrypted laptop that was stolen from the...

IT Security Horror Stories: Truth is Scarier Than Fiction

At Coalfire Labs, we discover--and help our clients address--some pretty scary security and compliance problems. Everyones heard of blood-sucking cyber criminals looking for vulnerable IT systems. Even when organizations have protections in place, these monsters just wont give up. Their appetite ...

RSA 2012: Mobile, Cloud, and Intelligent Control

It was good to catch up with our customers and partners at RSA 2012 this week. Much of the buzz this year was around mobile devices and securing the cloud. We were glad to see innovative organizations introducing compliance-validated architectures based on these emerging technologies. One such...

Formalized IT Security Policy Now Required for Government Prime and Sub-contractors

This month the GSA announced an IT security mandate for government prime- and sub-contractors that requires them to have a formalized IT security plan that includes periodic audits. Many government sub-contractors, large and small, will benefit from a third-party compliance program review so they...

Exercise your Incident Response Plan

So youve finally completed your Incident Response Plan. Youve named your team, defined roles, documented standard operating procedures, and establishing escalation processes. Heck, youve even got training material. So now what?...

Viruses and Vendors Can Put Healthcare Data At Risk

A recent article in Healthcare Security Info highlights that computer viruses can cause security breaches, that can then in turn compromise health care data and potentially violate the HIPAA and HITECH Act regulations. Beth Israel Deaconess Medical Center in Boston had to notify more than 2,000...

Compliance and the Cloud

"The Cloud" is a hot topic right now. Yet most people cant even define what "the cloud" really is. As I talk to more companies, who are considering the move, they all have two main concerns: security and compliance. Of course, security and compliance are key when it comes to cloud computing, but...

Top 10 challenges of building an in-house application security program

Building a successful application security program can be a daunting task, as it involves many different skill sets. Resource constraints, lack of expertise, and cultural resistance are among the many challenges preventing organizations from reaping the full benefits of an in-house AppSec program...

How Fortune 500s are building brand value by communicating security posture

With Covid and cloud migration driving new threats and vulnerabilities, security concerns are now top of mind with customers. As a result, buyer perception about an organizations security and compliance posture can be leveraged to build market trust and high-value brand magic for virtually every...

Hacking Ham Radio: WinAPRS – Part 3

In part two of this series, we reviewed our WinAPRS software and hardware configuration. We then began reverse engineering WinAPRS and fuzzing it for vulnerabilities using modified open-source software. Finally, we identified a potentially exploitable vulnerability. This installment will dig into...

Command injection in java: 80% proven that it is 100% impossible (sometimes)

I was reading Alex Smolens blog the other day and ran across the post "Command Injection Impossible in Java and .NET?" Interesting stuff! In an effort to avoid doing work I should actually be doing, I decided to look into it a bit more...

Asymmetric-key algorithms and symmetric-key algorithms

The symmetry of the algorithm comes from the fact that both parties involved share the same key for both encryption and decryption. It works similar to a physical door where everyone uses a copy of the same key to both lock and unlock the door. A symmetric-key algorithm, just like real doors,...

Key scoping factors when pursuing ISO 27001 certification

Service providers that seek the most recognized implementation of an information security baseline and governance structure should consider the ISO/IEC 27001:2013 "ISO 27001" standard. The information security management system ISMS prescribed by this widely adopted publication engages personnel ...

What to Expect in the initial FedRAMP briefing with your Agency Sponsor and the PMO

Most people who have spent any time researching the FedRAMP authorization process know there are two routes for a Cloud Service Provider CSP to become FedRAMP authorized: Agency and Joint Authorization Board JAB. Because of the limited number of CSPs selected each quarter for the JAB authorizatio...

What to Expect When You are Expecting… Your CISO to Leave

"The CISO is leaving the company. What are the next steps?" No executive likes to hear that a key member of the business is leaving the organization. Turnover among key business leaders isnt unusual, but as a factual matter, CISO average tenure is relatively short - approximately 24 to 48 months...

So your company has decided to do FedRAMP - What does that mean?

The exponential increase in cloud adoption in recent years has led to a dramatic increase in technology companies evolving from software and application companies to Software as a Service SaaS, Platform as a Service PaaS or Infrastructure as a Service IaaS providers. The 2011 release of the Cloud...

Applied ThreadFix: Effective security team collaboration

Modern enterprises are distributed. Most ThreadFix deployments have stakeholders spanning development and security teams and those team members are spread around the globe. To support these distributed organizations, ThreadFix has a number of collaboration features that make teams more efficient...

Applied ThreadFix: Automated Vulnerability Exception Reporting

One of the most valuable things about ThreadFix is that it centralizes the results of all your testing, assurance, and remediation activities so you no longer have separate silos of data. This is really valuable from a reporting standpoint. If you need to you can drill down into specific parts of...

Applied ThreadFix: Fire Bullets, Then Cannonballs – Part 2

In Part 1 of this blog post, we looked at the concept of "firing bullets and then cannonballs" that comes from the book Great By Choice by Jim Collins and Morten T. Hansen. The idea works a little like this: first fire your "bullets" - low-cost, low-risk, low-distraction experiments to figure out...

Humans Are the Weakest Link in Security

In our recent analysis of penetration testing engagements contained in our Penetration Risk Report, we discuss the impact that social engineering, specifically phishing, has on the ability to allow attackers insider access to compromise an organization...

AICPA Releases New SOC 2 Guide – What You Need to Know

In March 2018, the American Institute of Certified Public Accountants AICPA released its highly anticipated new System and Organization Controls 2 SOC 2 guide, which includes information for the extant 2016 trust services principles and the new 2017 trust services criteria. The following is a...

The Spectre of Chips on Meltdown

The news is rife with emerging details of Intel and other chip vulnerabilities and the hardware bugs that can potentially exploit them. While details are still developing and will likely continue to be uncovered in the days, weeks, and even months ahead, we will explore what is known to date...

Cybersecurity Incident Response: Three Lessons from Uber’s Story

The recent news regarding the Uber breach has captured the attention of both the public and legislators. It seems that Ubers security team discovered a breach, paid a ransom, and didnt report the matter to company leaders, law enforcement, personnel, or customers...

An Analysis of PCI DSS Requirement 11.3.4.1 and the Compliance Expectations

For some organizations, understanding, navigating, and complying with the Payment Card Industry PCI Data Security Standard DSS, especially after the release of the latest version v3.2 released in April 2016, has become confusing and/or challenging because of the inclusion of phased-in applicabili...

DevOps, Automation, Security and Compliance

Phew, the title of this post alone sounds like it could be quite a lot to deal with! So what is DevOps? DevOps is simply the blending of infrastructure operations processes and software development to enable faster changes to business applications/technology. These processes share a lot of ideolo...

Thoughts on BSides Las Vegas 2016

I recently attended "Infosec Week" in Vegas - Black Hat, BSides and DEFCON. BSides is a high point every year. This smaller Con has a plethora of perks which make it a "must attended" and also offers many of the same benefits or advantages or opportunities as Black Hat and DEFCON...

DerbyCon is right around the corner (Sept. 23 - 25)

DerbyCon is right around the corner Sept. 23 - 25 and we wanted to highlight two sessions that Coalfire Labs team members will be presenting...

The Future of Healthcare Cybersecurity: The Best Defense is a Good Offense

In the last five years with the increasing digitalization of health information, healthcare security breaches have increased four-fold with the industry experiencing more breaches than any other in 2013. With a large number of potential targets and the high value of personal medical information o...

HIMSS Privacy & Security Forum – West 2014 Wrap-Up

The first HIMSS Privacy & Security Forum in the western U.S. proved to be a success and was attended by over 300 people including attendees CEs and BAs, speakers, exhibitors, and partners. We reconnected with several clients and met new friends at our booth, which was located right in the middle ...

Heartbleed Vulnerability Bug: What You Need to Know

The widely publicized heartbleed bug http://heartbleed.com/ may be impacting as many as 500,000 systems across the Internet. Heartbleed is the name of a vulnerability in the OpenSSL program that powers encrypted communication to many of the worlds web sites and private networks. Below you will fi...

University Data Breaches Pose Threat to Students, Academic Openness

North Dakota State University administrators confirmed last week that hackers never accessed the personal information of more than 200,000 students, faculty and staff housed on the server they successfully infiltrated. This attack perfectly suits the modern hackers MO. They attack open systems...

Are you ready for PA-DSS 3.0?

Theres been a lot of chatter about PA-DSS 3.0 among several early-adopter application vendors. As of January 1, 2014 its permissible to validate against 3.0 in place of a 2.0 validation. Longevity of the 3.0 validation and the desire to be validated first on a new standard seem to be driving the...

Detecting and Preventing Compromises in Retail Payment Systems

Information Weeks Matthew Swartz published an article on the recently- confirmed payment card breaches at Target, Nieman Marcus and three other unnamed retailers. This article and many others reveal that these attacks involve sophisticated malware and some even suggest it is the work of the same...

What every CIO should know about the new ISO 27001:2013 framework

Originally released in 2005, the ISO 27001 standard has recently been updated with additional guidelines for assessing risks within information management systems. These changes constitute the first revisions to the standard in eight years and have major implications for organizational compliance...

2013 PCI SSC North America Meeting – Wrap-Up

Coalfire sent the entire team to the meeting in Las Vegas and everyone reported a positive and engaging experience. We hosted our annual dinner where we caught up with clients and friends - a good time was had by all. The most valuable technical information was presented during the Assessors Only...