A little actually doesn’t go a long way: Fight the urge to shortcut your TPRM program

Third Party Risk Management TPRM is hard to get right. Ineffective TPRM is when 83% of legal and compliance leaders identify third party risks after due diligence, despite spending 73% of effort on due diligence. This is supported by 49% of business leaders saying they lack a centralized strategy...

Governing the organization

Security is the biggest risk to business today. Managing security has become one of the hardest jobs in the enterprise, and failing to do so effectively can create opportunities for severe operational disruption. One of the keystone conclusions from Coalfires Cloud Advisory Boards the Smartest Pa...

A Bridge Over the Chasm: A Primer on the Release of PCI 4.0

The Payment Card Industry PCI Security Standards Council SSC has just released version 4.0 of the Data Security Standard DSS. Developing DSS 4.0 took almost four years and included several rounds of Request for Comments RFC from Participating Organizations and other interested parties. This new...

Certification body rebrands to Coalfire Certification

Were excited about our new name. It reflects what we do and where we are headed. We share this excitement with our clients and our teams and extend thanks to everyone that helped push the certification body to this level of framework coverage as Coalfire Certification enters this next period of...

Staying current with HITRUST advisory changes

As a result of an ever-evolving threat landscape, compliance requirements are proliferating at an unprecedented rate. It can be overwhelming to keep up with the staggering number of new and updated regulations, compliance frameworks, and standards. HITRUST®, founded in 2007, recognized this...

MIME sniffing in browsers and the security implications

Whenever a website in opened in a browser, there are many tasks that are being silently performed in the background. One of those tasks is fetching resources such as images, stylesheets and JavaScript from different domains on the internet and then parsing those resources...

Automated application scanning: handling complicated logins with AppScan (only!)

Ory Segal @orysegal from IBM Rational reached out with a simpler method to handle this natively in AppScan. It involves configuring AppScan to add a custom parameter to each request. For the sample case in the authexamples GitHub repository it would be handled like this...

Managing Application Vulnerabilities Manually?

In spite of the fact that automation and application vulnerability resolution platforms like ThreadFix have existed for a decent length of time, we continue to see organizations that try to muscle ahead with their existing manual processes. We continue to be surprised that organizations manage...

Help Net Security – ThreadFix 3.0 Review

Help Net Security recently published a review of ThreadFix 3.0. Security Researcher, Toni Grzinic, took a deep dive into our vulnerability management platform and broke down everything from infrastructure, reporting and analytics, to integrations, and beyond. Click here to read Tonis full review ...

Reflections on Women in Cybersecurity

I joined Coalfire in 2014. At the time, there were very few women in cyber, much less in leadership roles. As it sometimes happens, I found myself in an elevator with Tom McAndrew, who is now our CEO. We started talking about the direction of my career and plans for my role as Director of Coalfir...

State privacy laws: 2020 highs and lows

2020 is shaping up to be another interesting year for data privacy, especially given that public health agencies, private companies, and states are now working feverishly to create contact tracing apps and programs while still preserving privacy. Being thoughtful and accountable about data privac...

A strategy for cybersecurity strategy

Let's start with an assumption: Having a cybersecurity strategy is best practice. So, what makes a good cybersecurity strategy? You'd be surprised how this answer varies across the security industry, especially from seasoned CISOs of Fortune 500 companies...

Am I doing it right? An introspective look at "why it's like this"

Cybersecurity, as a practice within organizations, has existed for decades. Larger or government organizations have had dedicated cybersecurity functions in place since at least the 90s. By the early 2000s, organizations were appointing CISOs, and by the end of that decade over 85% of large...

So your company has decided to do FedRAMP - What does that mean?

The exponential increase in cloud adoption in recent years has led to a dramatic increase in technology companies evolving from software and application companies to Software as a Service SaaS, Platform as a Service PaaS or Infrastructure as a Service IaaS providers. The 2011 release of the Cloud...

What can Application Security Testing add to DevOps programs?

The adoption of DevOps practices by organizations to shorten the standard development lifecycle has put new pressure on security teams to keep up with the pace of development within CI/CD pipelines. In order to accomplish this, security teams need to provide better security insights to developers...

Dodge Data Breaches with Real-Time PCI Compliance

Its been five years since the PCI Council released the first "Best Practices for Maintaining PCI DSS Compliance" guidance document in August 2014. Since then, many prominent payment data breaches have occurred, with the finger often pointing to lapses in the affected organizations compliance...

Coalfire participates in cybersecurity disaster exercise at the 2019 HSCC Spring Summit

The Healthcare and Public Health Sector Coordinating Council HSCC conducted their biannual Joint Cybersecurity Working Group JCWG All-Hands Meeting on April 3-4, 2019. As a member of HSCC, Coalfire participated in the JCWG meeting with other security leaders from across the healthcare industry an...

Upcoming Changes to Cryptographic Findings in Q4 2018

The security world is a constantly changing and evolving landscape, and as part of Coalfire's commitment to security, we need to constantly review and update vulnerability information for vulnerability scanning to keep up. We've made some changes to previously acceptable vulnerability checks, whi...

A Cyber Engineering Primer: Vulnerability Management Lifecycle

According to the SANS Institute, "Vulnerability management is the process in which vulnerabilities in IT are identified and the risks of these vulnerabilities are evaluated. This evaluation leads to correcting the vulnerabilities and removing the risk or a formal risk acceptance by the management...

PCI Compliance: Early-TLS and Cloud Service Providers

Organizations tracking their PCI compliance are likely aware of the impending June 30, 2018 deadline to disable SSLv3 and early-TLS. This blog post examines the special case of Cloud Service Providers CSPs and how their customers should proceed to achieve compliance...

Cyber Engineering for 2018 and Beyond

2017 could be considered one of the most exciting or horrifying years in the technology industry. End-of-year statistics showed that the number of reported breaches in the business sector saw a 21% increase over the previous year, and headlines from all major news outlets were riddled with report...

Look Out! Risk Is on the Move, According to IoT Thought Leaders from Across the Globe

The IoT Security Summit 2017 in New York City in late October and the Security of Things World USA 2017 in San Diego last month were both packed with thought leaders from all parts of the IoT ecosystem - device manufacturers, telecom carriers, cloud providers, and early-adopter end users from...

She Powers Tech

November 28th at the Venetian in Las Vegas, AWS re:INVENT held an important session that could shape the future of technology. The sold-out session, SHE POWERS TECH: Women Supporting Women in Tech, filled a ballroom with 500 women in technology and a few men who were interested in the topic. The...

Blueborne – Don’t Panic!

Here is what we know right now: Security company Armis recently released research identifying eight newly discovered vulnerabilities that exist in the wireless communications protocol Bluetooth, which could potentially affect a large percentage of the estimated 8.2 billion Bluetooth enabled...

Getting cert-y with all-5 AWS certs

I thought my recent experience achieving all five 5 AWS certs might be helpful to others in the community that are looking to do the same. However, this blog isnt meant to stand on its own, and I encourage everyone interested in going for all 5 certs to read other blogs posts too...

SOC 2 Type 1 and SOC 2 Type 2 Frequently Asked Questions

Coalfires SOC Practice Directors Dixon Wright and Jeff Cook recently conducted a webinar on AWS and SOC Reporting, What you need to know. The presentation provided a lot of good points that organizations should know or be prepared for regardless of the technology that is being used. Below you wil...

2017 RSA Conference Highlights

Over five days, 45,000 consumers and thought leaders convened at the 2017 RSA Conference, sharing insights on how to stay ahead of todays - and tomorrows - cyber threats. Coalfire was in the thick of it, and here weve compiled some of the most important takeaways...

FedRAMP in Bloomberg

Recently Bloomberg Government published an article that describes the increasing awareness of the Federal Risk and Authorization Management Program FedRAMP as a major factor affecting the federal marketspace. The article indirectly indicates a major first-mover advantage, as there are "only 77...

What does the FBI have to say about ransomware

The FBI provided guidance on ransomware at a recent FBI/US Secret Service/ISAC event. They defined ransomware as a type of malware that is commonly transmitted through malicious email, which is disguised to look normal. Once the email link has been clicked on, or an email attachment has been...

EC Ruling Invalidates Safe Harbor - Now What?

In a ruling on October 7, 2015 the European Court of Justice ECJ invalidated the principal European component of the U.S.-E.U. Safe Harbor Framework when it ruled in Schrems v. Data Protection Commissioner. In the ruling the court said that the existing U.S.-EU Safe Harbor agreement, overseen by...

RFPs and Needs Assessments for Higher Education

In this blog post, I will be discussing RFP best practices for Higher Education Institutions. Having worked with higher education organizations for a number of years, Ive noticed some trends that could be useful as you and your department or institution head into another year of projects that may...

Coalfire Receives Investment from The Carlyle Group and The Chertoff Group

Im pleased to announce that we recently closed on a significant investment from The Carlyle Group and The Chertoff Group - two prestigious investment groups that both have extensive experience in the cybersecurity space. The selection of these two firms came after an extensive six-month process o...

COSO Framework for Service Organizations and SOC Reporting (Part 3 of 3)

In part 1 of this series, we discussed the recent changes to the COSO framework and the overall impact that the updated framework has on service organizations that receive Service Organization Controls SOC reports...

PCI DSS version 3.1 released!

As expected, a "minor" revision to the PCI DSS 3.0 standard now version 3.1 was released by the PCI SSC today to address the vulnerabilities exposed by the POODLE and BEAST browser attacks. PCI DSS 3.1 primarily addresses the insecure use of SSL as an encryption protocol within a Cardholder Data...

Their Claim to Fame – So-Called HIPAA-Compliance Experts and Tools

Have you noticed how many vendors and software solutions are out there claiming they can make you HIPAA-compliant? Well, at the end of the day thats simply not possible because only you can make your organization HIPAA-compliant. I came up with a list of "red flags" that I typically see from...

IT Security Horror Story: Is your Network an Unsegmented Haunted House?

One day I went to a client site to perform internal penetration test to emulate the insider threat. This testing was designed to help this client understand the damage a rogue employee or an intruder who gained physical access to the network could do. The site that I was visiting was a storefront...

Embracing the Cloud's Potential for Security

I spoke recently at TIAs Network of the Future conference. At the session, which was heavier on vendors than operators, the discussion was very focused on the cloud. Everyone wants to know whats coming next and if theyre ready for it...

DoD DIACAP transition to RMF approved

Welcome DIARMF! This has been a long time coming. From DITSCAP to DIACAP and now to DIARMF the Department of Defense approved the transition to a Risk Management Framework RMF approach developed by NIST on March 12. What does this mean for Information Systems and Platform Information Technology...

The PCI DSS 3.0 SAQs are here!

The Payment Card Industry Security Standards Council PCI SSC released Data Security Standards DSS 3.0 in November 2013 and has just released the related Self-Assessment Questionnaires SAQ. There are two new SAQs, SAQ A-EP and SAQ B-IP...

A Proven Strategy for Implementing Vendor Management Programs

Every regulated industry includes a requirement for managing third-party risk. Some industries are further along the path and have more mature processes than others. However, there are tried and true methodologies and standards established by those early movers that we can utilize across other...

IT Security Horror Story #3: Ghost in the Machine

A supernatural sequence of automotive portals and applications yield a ghostly in-car phenomenon. READ MORE…IF YOU DARE -...

College students concerned about information security

Universities and colleges have been under significant pressure to upgrade their technology both in and out of the classroom. For instance, many organizations turn to mobility as a way to engage students and facilitate learning campus-wide. While much of the discussion is around issues such as the...

Highlights of Newly Released PCI DSS 3.0 Information

The standards are coming! The PCI SSC has finally let loose with some much needed information regarding the upcoming releases of the PCI DSS 3.0 and PA DSS 3.0 standards. Available on the PCI SSC website; the document titled "Version 3.0 Change Highlights" contains information on what PCI...

All Aboard the HIPAA Omnibus - but is the ‘bus’ missing anything?

In the wake of the recently-released HIPAA Omnibus Rule with its upcoming deadline, healthcare organizations are trying to figure out how theyre going to achieve compliance. Weve been busy trying to get through the 563-page rule and determine what it means to our clients...

The PCI SAQ P2PE-HW: Patience, POIs and PIMs

The new PCI SAQ P2PE-HW Point to Point Encryption Self-Assessment Questionnaire was released in July 2012, and many merchants are excited about the prospect of a shorter, less arduous compliance validation effort. After all, its significantly shorter than the SAQ-D; instead 12 sections, there are...

What's Next in Retail IT? The Convergence of Mobile, P2PE and the Cloud

Greetings from the Javits Center in New York City, the site of the National Retail Federations Big Show. This year, the theme of NRF is "Next". When it comes to Retail technology - and in particular, security and compliance, the most talked about "next" things are:...

VMware releases PCI Solution Guide and it has good news for compliance-oriented buyers

This month VMware release an important document, the VMware Solution Guide for Payment Card Industry PCI. Its significant because it is the first document of its kind to map the PCI requirements - including those authored by the PCI SSCs Virtualization SIG - to a commercially-available stack of...

Data Privacy Day 2012 – BYOD

January marks Data Privacy Month and on January 28th we celebrated Data Privacy Day. In the past year, we have seen an increase in the consumerization of IT and "Bring Your Own Device" BYOD in the enterprise. In honor of Data Privacy Day 2012, we have partnered with The Center for Identity at The...

Coalfire Systems Assessment: Merchant Link’s TransactionShield and TransactionVault Reduce Merchant’s PCI Scope

Merchants spend a lot of time and money developing IT controls programs to protect consumer credit card data. Through our work with thousands of retailers, weve learned that one of the best ways to contain costs and reduce risk is to keep cardholder data out of as many systems and business...

Is it Safe to Speak? Protection for Telephone-Based Payment Card Data

Recently, the PCI Security Standards Council released educational resource requirements for securing cardholder data in audio recordings. The PCI SSC has been focusing on call center operations and recording systems of merchants. The need to provide a secure system to protect cardholder data is a...