Click on the questions below in the Table of Contents for the most recent answers. If you have a question that is not answered here please contact me at jerry@wintsecconsulting.com or 609-576-0348. Thank you Jerry

CVSS stands for Common Vulnerability Scoring System.  It is a standard by which system vulnerabilities are defined on a scale of low to critical. The exact method of determining is not important. What is important is close attention to alerts when you or your IT advisor receive them. This is why it is important to subscribe to NJCCIC. Their newsletter is very informative. Most systems these days can be patched on a regular basis, especially Microsoft. Work with your IT advisor to do regular updates once per month. When handled this way should only take 5-10 minutes and perhaps a reboot.

An example would be the External Network Vulnerability Scanning, which is currently offered through D2 Cyber Security to ACM JIF members.

That is fine.  As noted, there are many situations where unsupported programs are forced to be used. 

Yes, the third-party vendor questionnaire is the tool.  It is on the MEL website: https://njmel.org/mel-safety-institute/resource-center/public-officials/public-officials-cyber-risk-control/

You can find these tools under the category of SAM (Software Asset Manager).  Just Googling, here are a few that popped up: Network Inventory Advisor, AssetExplorer, Asset Panda.

These are labeled DLP (data loss prevention), and a quick Google search generates many. 

No, the town should use an Enterprise Password Management tool to manage the passwords across the organization.

LastPass is one example.  There’s plenty of them out there…..just looking for an EPM that securely stores passwords across an organization and helps users manage their passwords.

Privileged Access Management Tool.  This control does not discuss MFA.  Here is our description: A Privileged Access Management (PAM) tool manages execution of privileges, but especially important for elevated privileges. This extends beyond storage of passwords. PAM tools are able apply granular control of privilege execution beyond what exists in applications and remove privileges after execution is complete. PAM tools can manage accounts with username and passwords or stored secrets. Some examples of PAM are CyberArk, and Thycotic (Fund Underwriter)

PAM tools apply ONLY to those with privileged access. In most cases this is the Administrator, although in some cases other login accounts may have elevated privileges and should be treated accordingly. PAM tools do NOT need to be deployed to every user at this time although this is subject to change. (approved by Fund Underwriter)

PLEASE UNDERSTAND THE UNDERWRITER DOES NOT SPECIFY THE METHOD OF PAM COMPLIANCE HOWEVER AN ACCEPTABLE PAM SHOULD HAVE THE ELEMENTS BELOW.

Key Features of a PAM include:

   – Credential Vaulting: Securing and isolating privileged account passwords in a vault.

               IT administrators must use an offline product such as IT-Glue or Ninja RMM to maintain the record of critical passwords.  

 – Session Management and Monitoring: Recording, archiving, and monitoring privileged user sessions for suspicious activities.

              Auditing should be enabled for the admin account.

      – Multi-factor Authentication: Requiring additional verification before granting privileged access.

              IT administrators must deploy MFA such as DUO whenever a privileged is used.

   – Role-based Access Controls (RBAC): Assigning access based on roles within an organization.

               No users other than the administrator should have admin privileges and the administrator should be renamed.

 – Automated Password Rotation: Changing passwords at set intervals or after every use.

              Admin passwords should be changed after each use or every 90 days whichever comes first.

THE ABOVE DOES NOT REQUIRE SPECIAL SOFTWARE BEYOND A PASSWORD VAULT AND MFA APPLICATION. THE REMAINING FEATURES ARE BUILT-IN TO THE WINDOWS OPERATING SYSTEM AND JUST NEED TO BE DEPLOYED.

We do not suggest/certify vendors, but most security/antivirus companies can provide the service.  HaveIBeenPwned is a very popular one. 

They should be one-in-the same, but EDR (and like terms) are being stretched very far today, so we want to ensure the behavior-based AM is specifically noted.

Yes, the town should be notified and able to respond 24×7. 

We do not recommend or approve tools.  But for reference, something like SecurityScorecard is what we are looking for to help clients monitor their third party vendors. 

We are looking to address vendors you have a connection to or who store/manage your sensitive data, and we do not have to address the mega companies, like Microsoft, Google, AWS, etc.  This may mean financial, accounting, payroll, or health, and Axon can be included.  Examples of tools would be like what SecurityScorecard or BitSight offer.

No, specific penetration testing. Also, D2 will continue to provide the penetration testing for ACM JIF Members for 2023.  As for 2024, the ACM JIF has the option to renew the contract for one more year. We are hopeful the service will be provided by the Cyber JIF by 2024.