Thoughts on BSides Las Vegas 2016

I recently attended "Infosec Week" in Vegas - Black Hat, BSides and DEFCON. BSides is a high point every year. This smaller Con has a plethora of perks which make it a "must attended" and also offers many of the same benefits or advantages or opportunities as Black Hat and DEFCON...

The Future of Healthcare Cybersecurity: The Best Defense is a Good Offense

In the last five years with the increasing digitalization of health information, healthcare security breaches have increased four-fold with the industry experiencing more breaches than any other in 2013. With a large number of potential targets and the high value of personal medical information o...

PCI Community Meeting Keynote

Admiral James Stavridis delivered this mornings PCI Community Meeting keynote presentation, Sailing the Cyber Sea: The New Realities of 21st Century Security to an engaged and near-capacity crowd. Admiral Stavridis, a four-star admiral and former NATO Supreme Allied Commander, touched briefly on...

Forensics Session Takeaways from Day 2

Day two of the PCI Community Meeting presented an array of security topics ranging from best practices, EMV, security awareness, and more. I had the pleasure of sitting in on a forensics presentation, which leveraged information from a variety of industry leaders and provided valuable insight int...

HIMSS Privacy & Security Forum – West 2014 Wrap-Up

The first HIMSS Privacy & Security Forum in the western U.S. proved to be a success and was attended by over 300 people including attendees CEs and BAs, speakers, exhibitors, and partners. We reconnected with several clients and met new friends at our booth, which was located right in the middle ...

Are you ready for PA-DSS 3.0?

Theres been a lot of chatter about PA-DSS 3.0 among several early-adopter application vendors. As of January 1, 2014 its permissible to validate against 3.0 in place of a 2.0 validation. Longevity of the 3.0 validation and the desire to be validated first on a new standard seem to be driving the...

Detecting and Preventing Compromises in Retail Payment Systems

Information Weeks Matthew Swartz published an article on the recently- confirmed payment card breaches at Target, Nieman Marcus and three other unnamed retailers. This article and many others reveal that these attacks involve sophisticated malware and some even suggest it is the work of the same...

What every CIO should know about the new ISO 27001:2013 framework

Originally released in 2005, the ISO 27001 standard has recently been updated with additional guidelines for assessing risks within information management systems. These changes constitute the first revisions to the standard in eight years and have major implications for organizational compliance...

2013 PCI SSC North America Meeting – Wrap-Up

Coalfire sent the entire team to the meeting in Las Vegas and everyone reported a positive and engaging experience. We hosted our annual dinner where we caught up with clients and friends - a good time was had by all. The most valuable technical information was presented during the Assessors Only...

Proudly Supporting Our Country’s Navy Reserves

July is a month in which we celebrate our nations independence and we hope that youve had the chance to reflect on the many freedoms and blessing we enjoy as citizens of the United States. At Coalfire, we know full well that those freedoms have been paid for, at least in part by the Americas...

The Budding Healthcare IT Spring

HIMSS12 is in full production in Las Vegas this week. Over 40,000 healthcare IT professionals and service providers have descended upon a conference that will set the direction for a new wave to technology innovations for the healthcare industry. Almost every booth has a sign that extolls the...

GivingFirst Launches online Charity Processing Service

In the spirit of the Holiday Season, Coalfire has made a significant contribution to GivingFirst.org in the form of free Penetration Testing services. GivingFirst is a Denver-based community foundation whose mission is "to improve quality of life by increasing community generosity and involvement...

New Guidelines Address PCI DSS Tokenization

"Tokenization" is one of the best techniques to reduce the risk of credit card data loss. Basically, it is the process of substituting sensitive data with other values not considered sensitive. By doing this, tokenization technology essentially removes anything of value from the data stream, and,...

This Week: Coalfire Systems in the News

Its been quite a week in the world of IT security, and as experts in our field, we are often asked to comment on current trends and recent stories. Take some time to check out what we had to say recently:...

Mobile Application Security – The New Frontier

The power and popularity of consumer mobile computing is changing faster then you can say iFart the 1 downloaded app worldwide. Commercial entities are rapidly adopting mobile-based applications for retail sales floors, restaurants and dining rooms, distributed mobile banking, and more...

Full Steam Ahead! Coalfire Systems Secures $5 Million in Funding from Baird Venture Partners

People often ask me what defines a successful company. At Coalfire Systems, its having a clear roadmap of services that clients need and want, which in turn drives growth and expansion. I am pleased to announce that Coalfire Systems has received an investment of $5 million dollars from Baird...

Spotlight: Women of Coalfire part 2

Its been nearly 50 years since Congress formally recognized the 1920 certification of the 19th Amendment to the Constitution with Womens Equality Day on August 26. In the last half-century, women have made significant strides in the workforce and the world, but still face adversity due to their...

What’s in a Name? – Why Gartner Picking “Application Vulnerability Correlation” is an Important Step for the Application Security Market

If you havent seen it yet, Gartner just published its "Hype Cycle for Application Security, 2016" written by Gartner Analyst Ayal Tirosh with support from colleague Lawrence Pingree Gartner clients can view it at https://www.gartner.com/doc/3376617/hype-cycle-application-security-. This is...

Cybersecurity Risk Management – From HIPAA to HITRUST

Cybersecurity risk management for healthcare organizations continues to be a perplexing issue. While it is explicit in the security management standard of the HIPAA Security Rule that a Covered Entity and their Business Associates must conduct an "accurate and thorough" risk analysis teamed with ...

Managing Web Application Security

Web application scanners using dynamic application security testing DAST methods are ideal at identifying common vulnerabilities such as cross-site scripting, SQL injection, command execution and more. When used in conjunction with whitebox static application security testing SAST results that...

A Cyber Engineering Primer: Automated Tools for Compliance Auditing

Cybersecurity practitioners sometimes forget to define and explain the terms we use during the course of our work. Thus, my colleagues and I have embarked on a series of posts that provide a primer on some of the most important cyber engineering practices. In this post, we will focus on...

Information and guidance for dealing with WannaCry

Coalfire continues to closely monitor the WannaCry ransomware attack. Much has been written over the past few days about the attack. For those of you who may not have had time to review in detail and assess appropriate actions for your organization, we wanted to provide summary information...

Hacker Summer Camp – Recap of BSidesLV, Black Hat & Defcon

What a week! Hacker summer camp in Vegas was amazing! This was my first time through for all three of the conferences in Vegas - BSidesLV, Black Hat, and Defcon. Ive been to BSidesLV and Defcon plenty of times, but experiencing all of these back-to-back -to-back!, with a bit of overlap gives a...

The Ghosts Inside - Horror Stories 2015

By 8 p.m. the donuts from the previous day had gone stale, what was left of them anyway. There was the eerie feeling of spirits in the night mist tonight. It was late October and the chill was thick with Halloween. You could smell it in the haze. I consider myself quite tough, but when you are a...

PCI Scope Assessments for Higher Education Institutions

With the release of PCI DSS version 3.0 and more recently 3.1, many Higher Education Institutions have found it hard to know which SAQs they should be filling out since there are now nine options. Higher Education Institutions have very complex merchant card environments and with the new...

Anthem Data Breach - A Message from Coalfire's Healthcare Practice Director

Several weeks ago I had the opportunity to speak on a panel at a healthcare conference. In attendance were CIOs, CISOs, VPs of IT, and members of legal counsel. The individuals attending the session represented organizations ranging from small- to medium-sized business associates all the way up t...

Truth is SCARIER than Fiction Redux

Yes... To be honest, although we really do some neat stuff here at Coalfire Labs that can be pretty scary, Ive got to give a shout out to "reality" for being even scarier than any emulated attack we could possibly develop. The astounding number of data breaches announced this year is just shockin...

Two final thoughts from the PCI Community Meeting

The 2014 North American PCI Community Meeting has drawn to a close, but the messages and lessons learned will continue to resonate with me long after Ive returned home to Denver. There were two messages from the SSC this week that really struck a chord with me and I wanted to expand on why I thin...

Would EMV Help?

With the spate of cyber attackers on US retailers recently, Coalfires European Managing Director, Andrew Barratt considers how the attacks on retailers differ outside the US and what the potential impact of similar attacks is in a world where chip and pin technology is more widely deployed...

Are you in danger of missing the HIPAA Omnibus?

On September 23, 2013, many companies will be required by law to comply with HIPAA…and they dont even know it. Specifically, the final HIPAA Omnibus Rule pulls all companies under the law if they store, process, or transmit PHI data as part of their business processes. While the Omnibus Rule was...

South Carolina Data Breach Survey Results on Residents' Attitudes

Coalfire recently conducted a survey of South Carolina residents who were victims of the recent data breach at the Department of Revenue. The data breach affected residents of the State who had filed their taxes online exposing 3.8 million taxpayer Social Security numbers and nearly 400,000 credi...

Surprises Ahead for Some Level 2 Merchants

The PCI DSS has been around for years, and most PCI "pros" are familiar with the processes needed to validate compliance. However, insiders often forget that small changes to the guidelines can have a big impact on merchants. One such change is upon us: MasterCards new validation guidelines for...

Where should CISO report?

A key question faced by many organizations in defining the role and responsibilities of the security organization, is where to align the most senior information security executive, typically referred to as the Chief Information Security Officer or CISO. To answer this question it is important to...

Why are companies still managing compliance with spreadsheets?

Compliance management and automation has come a long way in just the last couple of years, and market demand for cyber assurance is at an all-time high. So why are so many companies still managing their compliance programs with spreadsheets?...

A Cyber Engineering Primer: System Compliance and Hardening

Cybersecurity is a hot topic for just about everyone: it affects organizations as well as individuals, workers, and citizens. Each of us needs at least a basic understanding of how to safely use and protect the devices and systems that are a part of our day-to-day lives...

FedRAMP Tailored program for low-risk use cloud service offerings

On February 16, the FedRAMP Project Management Office PMO released the new FedRAMP Tailored security controls baseline for public comment comment period closes March 17, 2017. The new FedRAMP Tailored security controls baseline was created for Cloud Service Providers CSPs who have cloud service...

Funeral Services for Rick Dakin

The funeral for Rick Dakin will be held on Tuesday, June 30 at 10 a.m. at the Gatehouse Lionsgate, located at 1055 South 112th Street, Hwy 287, Lafayette, CO 80026. Arrangements are being made through the Crist Mortuary in Boulder, Colorado. An online memorial page and guestbook will be set up...

Reporting LIVE from the HIMSS 2015 Cybersecurity Command Center

Well, its not exactly live anymore but it certainly was worth tweeting live from the brand new Cybersecurity Command Center CCC at HIMSS 2015 in Chicago a couple weeks ago given all the excitement. The CCC was the place to be at HIMSS this year with standing room only at the educational sessions...

What “Dexter Malware” tells us about the future of POS security (It might just be P2PE)

The recently announced Dexter malware is targeting POS systems and once in, it collects sensitive credit card data and surreptitiously sends it off to attackers. While the details of this particular attack are not yet available, this is not the first time this general approach has been exploited...

FedRAMP Question and Answer session from PMO webinar

On October 25, the FedRAMP PMO conducted its first webinar, in what will be a series of webinars, on the FedRAMP process. This first webinar covered the four methods that CSPs can get listed in the FedRAMP repository. This webinar is well worth the time to listen to it. The PMO had a lengthy Q&A...

What is Your Risk Assessment Worth?

A risk assessment provides your organization with a tool to determine how, where and how much to invest in controls and security over technology. It also serves to document the risk acceptance policy of your organization as the acceptable level of risk dictates the level of controls to be...

Can we kick the attachment habit?

As consumers of messaging services, particularly email, we have become addicted to attachments. This habit has become an easy avenue for mounting cyber-attacks against an organization. In the 2010 Verizon Data Breach Investigations Report, conducted in cooperation with the United States Secret...

Corporate demand for cybersecurity ROI drives CISO metrics

Increasing cyber risks and decreasing budgets mean that C-suites and boards are demanding better cyber performance metrics and reporting from security teams...

Sitting in cars with hackers

Are organizations doing enough to protect customer data? The auto industry can teach us a lot about vulnerability management...

Why are companies still managing compliance with spreadsheets?

Compliance management and automation has come a long way in just the last couple of years, and market demand for cyber assurance is at an all-time high. So why are so many companies still managing their compliance programs with spreadsheets?...

Privacy by design: Building customer trust

Historically, the question of privacy has been the domain of the legal community. This makes perfect sense, because privacy has its roots almost exclusively in laws and regulations. The EU General Data Protection Regulation GDPR, the California Consumer Privacy Act CCPA, and similar regulations...

Top 10 Things CSPs Need to Know about FedRAMP Authorization on Amazon Web Services

Coalfire conducted a webinar, FedRAMP on AWS: What you need to know. The discussion covered what cloud service providers need to know when pursuing FedRAMP authorization leveraging AWS U.S East/West or GovCloud. Below youll find the Top 10 things that cloud service providers should know...

FedRAMP Plans for 2017

The Federal Risk and Authorization Management Program FedRAMP plans to continue to build on 2016 successes by planning for an ambitious 2017 according to a series of blog posts released by the General Services Administration GSA...

Chip Cards Finally Come to America – But What Does it Mean for Merchants and Consumers?

Like it or not, today the U.S. finally adopts EMV technology. While the implementation by most major retailers and large U.S. banks is expected to be delayed, the "chip and PIN" card types are coming to America to stay. The real debate is, will EMV adoption do anything for card data security?...

FedRAMP deadline- Industry and Agency Days

The FedRAMP PMO sent out a notification that they are holding a FedRAMP Industry Day on June 4, 2014 and an Agency Day on June 10, 2014. Items to discuss include the June 5, 2014 deadline, NIST SP 800-53 rev 4 transitions and the 3PAO privitization progress to name a few. We wanted to republish t...