New HC3 report defines security assessments needed for healthcare organizations during and after COVID-19

Rich Curtiss, Director, Healthcare Cyber Risk Services, Coalfire

The Health Sector Cybersecurity Coordination Center (HC3) recently delivered a report that defines and articulates the security assessments and information technology audits that should be considered during and after the COVID-19 pandemic.

Headless, Unattended Scanning in Burp Suite Professional 2.0 with Seltzer

Gabriel Merritt, Senior Security Consultant, Coalfire Labs

Burp Suite Professional (Burp) is one of the best tools available for penetration testers. It is feature-rich, intuitive, well-supported, and customizable. However, it can be difficult to use Burp for headless, unattended scanning. Alternatives such as Burp Suite Enterprise exist, but those of us with Burp Suite Professional may want to leverage it to perform this type of work. For years, my tool of choice for this has been the Burp extension Carbonator. Available in the BApp Store, Carbonator provides a means to interact with Burp via the command line, scanning a target and exporting the results as HTML. It is a great extension that has worked well, until the release of Burp 2.0.

A new way to manage supply chain risk – Introducing the AICPA SOC for Supply Chain report

Jeff Cook, SOC Director, Coalfire

With the continuation of its System and Organization Controls (SOC) suite of services (SOC 2®, SOC for Cybersecurity, etc.), the American Institute of Certified Public Accountants (AICPA) has released a new report format that focuses on manufacturing and distribution supply chains. The AICPA’s SOC for Supply Chain framework helps these organizations communicate their processes and controls to support their supply chain risk management, as well as to detect, prevent, and respond to supply chain risks. Organizations can also use SOC for Supply Chain reports to help understand and manage their external risks (including cybersecurity) that are typically related to their vendor or distribution networks.

Establishing risk appetite is key to effective risk management

Mandy Pote, Director, Cyber Risk Services, Coalfire

The mission of an enterprise risk management program is to respond to and monitor risks to the enterprise’s operations and objectives. In order to properly respond to and monitor risks, the enterprise must establish risk appetite thresholds. Well-established and well-communicated risk appetite thresholds will ensure that risks are mitigated consistently at all levels of the organization.

Remote Workforce is NOT the New Norm, but “Secure Work Anywhere” Should Be

Jonathan Leach, Principal, Cyber Risk Services, Coalfire

Secure Work Anywhere (SWA) is a new term for an old idea that is quickly becoming an industry standard. The overall principles of SWA are not new, but the risks associated with increased rates of workers connecting from potentially unsecure networks highlight the importance of those principles now more than ever. Although your workers may not always be remote, they should always be secure.