Ian Gordon

𝗕𝗼𝗹𝗱 𝗽𝗿𝗲𝗱𝗶𝗰𝘁𝗶𝗼𝗻 𝘁𝗶𝗺𝗲: 𝗖𝗠𝗠𝗖 𝗿𝘂𝗹𝗲𝗺𝗮𝗸𝗶𝗻𝗴 𝗲𝗱𝗶𝘁𝗶𝗼𝗻 - 𝗧𝗵𝗲 𝟯𝟮 𝗖𝗙𝗥 𝗖𝗠𝗠𝗖 𝗳𝗶𝗻𝗮𝗹 𝗿𝘂𝗹𝗲 𝘄𝗶𝗹𝗹 𝗯𝗲 𝗽𝘂𝗯𝗹𝗶𝘀𝗵𝗲𝗱 𝗯𝘆 𝘁𝗵𝗲 𝗲𝗻𝗱 𝗼𝗳 𝟮𝟬𝟮𝟰 - 𝗧𝗵𝗲 𝟰𝟴 𝗖𝗙𝗥 𝗖𝗠𝗠𝗖 𝗳𝗶𝗻𝗮𝗹 𝗿𝘂𝗹𝗲 𝘄𝗶𝗹𝗹 𝗯𝗲 𝗽𝘂𝗯𝗹𝗶𝘀𝗵𝗲𝗱 𝗮𝘁 𝘁𝗵𝗲 𝗲𝗻𝗱 𝗼𝗳 𝟮𝟬𝟮𝟱 This matters because DoD's "phased roll-out" for CMMC in contracts starts with the 48 CFR final rule revising DFARS clause 252.204-7021 to match the program details codified by the 32 CFR CMMC final rule. However, once the CMMC program is live thanks to the 32 CFR final rule, all bets are off: anyone can pay for an official CMMC assessment at that point. This means that the "market roll-out" will start long before DoD contractually requires anyone to have a certification and there's nothing DoD can really do about it. The most recent DFARS open cases report shows that the 48 CFR rule is bouncing around for revisions inside DoD which will add tons of time to before it's published even as a proposed rule. Competition and prime contractor questionnaires will drive a stampede of companies desperate for certification assessments while DoD scribbles away.

76

13 Comments

SAFECOM Publishes 2023 SAFECOM Annual Summary Read more on the link below. #defense #sbir #military #jointwerx #cmmc #cyber #cybersecurity @jointwerx @blackhaysgroup #GovernmentContracts #InfoSec #CyberDefense #NationalSecurity #DigitalTransformation #PublicSector #Startups #TechInnovation

3

SAFECOM Publishes 2024 SAFECOM Strategic Plan Read more on the link below. #defense #sbir #military #jointwerx #cmmc #cyber #cybersecurity @jointwerx @blackhaysgroup #GovernmentContracts #InfoSec #CyberDefense #NationalSecurity #DigitalTransformation #PublicSector #Startups #TechInnovation

1

INSIDER RISK MANAGEMENT (IRM) PROGRAM EVALUATION & OPTIMIZATION TRAINING COURSE / LAUREL, MARYLAND Offered By: Insider Threat Defense Group (ITDG) IRM Program Evaluator & Optimization Specialist Certificate This training courses is designed for anyone managing or supporting an Insider Threat Program (ITP) or an IRM Program. This training will provide students with the comprehensive knowledge and resources to develop, manage and evaluate an IRM Program, identify organizational security gaps, and provide actionable steps and cost effective strategies to create a comprehensive and optimized program. This training will ensure key stakeholders are universally aligned from an enterprise / holistic perspective to identify, prevent or mitigate employee risks / threats. This training provides students with an IRM Program Toolkit. The toolkit provides a handbook and an abundance of training materials, educational resources, templates and checklists for program development, management and optimization. LOCATION:  Johns Hopkins University Applied Physics Laboratory, Laurel, Maryland DATES:   July 29 & 30 / 8AM To 5PM COST:   $1,095 Early Bird Pricing Between June 11 To July 8 / $1,195 After After July 8 Complete Details / Registration (Money Back Training Guarantee) https://lnkd.in/eqgXn2FN COMPANY RECOGNITION  Our training courses have received exceptional reviews from our students. We encourage you to read the feedback from our students on this link. https://bit.ly/3VmPtk4 Over 1000+ individuals have attended our training courses and received ITP Manager / Insider Risk Program Manager Certificates. The ITDG Has Provided IRM Training / Consulting Services To An Impressive List Of 675+ Clients: White House, U.S. Government Agencies, Department Of Defense, Intelligence Community Agencies, Critical Infrastructure Providers, Universities, Microsoft, Verizon, Nationwide Insurance, Home Depot, Nike, Tesla, United Parcel Service, Federal Express, Visa, American Express, Equifax, Delta Airlines and many more. Full Client Listing: https://bit.ly/3RoLylT #insider #threat #threats #insiderthreat #insiderthreats #risk #risks #program #manager #development #management #mitigation #framework #optimization #maturity #evaluation #assessor #assessment  #vulnerability #training #course #certificate #certification #counter #global #professional #security

2

https://lnkd.in/e_7Gr6Jr Looking for a career roadmap for security/compliance/information assurance? Then check out DODs 8570 baseline certifications. The IA baseline certifications bring several values: Standardization: It ensures that DoD personnel working in information assurance have a baseline level of knowledge and competency. This helps to improve the overall security posture of DoD information systems. Reduced Risk: By requiring personnel to have relevant certifications, the DoD can help to mitigate the risk of cyberattacks and data breaches. Career Development: These certifications can help DoD personnel to advance their careers in information assurance. Many certifications are recognized by employers outside the DoD as well. Clear Requirements: The document lays out a clear roadmap for DoD personnel to understand the certifications needed for their specific roles. Overall, the IA baseline certifications contribute to a more secure and knowledgeable DoD information assurance workforce.

3

1 Comment

Did you know that #CBRNResponder has a YouTube channel with over 90 how-to videos?! Check it out to learn more about a specific feature or function of CBRNResponder: https://lnkd.in/gzya-5ps

7

New from Jen Easterly, Director, Cybersecurity and Infrastructure Security Agency, addressing this year's Cyber Storm exercise. I'm grateful some our Gate 15 team and orgs we support were able to participate in this significant national exercise. "Cyber threat actors continue to infiltrate critical #infrastructure networks with increased sophistication, persistence, and malicious intent. While some actors remain financially motivated, others such as nation-state actors aligned with the People’s Republic of #China, aim to compromise U.S. critical infrastructure networks to potentially disrupt critical services in the event of a geopolitical conflict. Organizations need to be prepared to respond and remain resilient in the face of these challenging threats, and exercises, such as #CyberStorm, serve as a critical tool to enhance preparedness. A few weeks ago, approximately one hundred exercise planners convened at CISA headquarters for the ninth iteration of the national cyber exercise, Cyber Storm. The planners, representing private industry, federal, state, and international government partners, managed an exercise that spanned across the globe to simulate a coordinated #cyberattack targeting critical infrastructure. What sets Cyber Storm apart from other cyber exercises is the depth and breadth of the exercise. We hosted over 2,200 participants from 300 organizations from more than 80 private sector companies, 35 federal departments and agencies, 11 states, and nine partner countries… Cyber Storm gave the participants an opportunity to exercise organizational response plans and capabilities, foster relationships with counterparts, and improve organizational and national cyber readiness and resilience. Participating organizations worked directly with CISA and coordinating bodies such as Sector Risk Management Agencies and Information Sharing and Analysis Centers to understand roles and capabilities during a cyberattack…" https://lnkd.in/emBig_j3 #cybersecurity #gate15 #cisa #preparedness #resilience

1

DFARS 252.204-7012 is a Defense Federal Acquisition Regulation Supplement clause that deals with safeguarding covered defense information and cyber incident reporting. Here's a breakdown of the key aspects of this clause in bullet points: - Purpose and Scope:   - It aims to protect covered defense information that resides in or transits through contractor and subcontractor systems.  - It applies to all forms of contracts with the Department of Defense (DoD) including subcontractors where covered defense information is handled. - Definition of Covered Defense Information:  - This includes unclassified controlled technical information or other information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and government-wide policies. - Cybersecurity Requirements:   - Contractors are required to provide adequate security on all covered contractor information systems.   - Specifically, contractors must implement the security requirements specified by the National Institute of Standards and Technology (NIST) Special Publication 800-171. - Cyber Incident Reporting:   - Contractors must report any cyber incidents that affect covered defense information or the contractor’s ability to perform tasks critical to the fulfillment of a DoD program.   - Reports must be submitted within 72 hours of discovery to the DoD Cyber Crime Center (DC3). - Media Preservation and Protection:   - Following a cyber incident, the contractor must preserve and protect images of all known affected information systems and all relevant monitoring/packet capture data for at least 90 days. - Flow Down Requirement:   - The clause mandates that the requirements must be flowed down to all subcontractors that are involved in handling covered defense information. - Access to Information:   - To assess compliance with the safeguards, DoD and other authorized government operations may audit, inspect, or examine contractor and subcontractor facilities and activities. - Cloud Computing Services:   - If a contractor intends to use cloud computing services to store, process, or transmit covered defense information, they must ensure that the cloud service meets security requirements equivalent to those established by the government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline. - Training Requirements:   - Contractors must conduct awareness training for all employees to enhance protection for covered defense information and to ensure proper actions in the event of a cyber incident. This clause is a critical part of the DoD's effort to strengthen cybersecurity practices across its supply chain, reflecting the growing importance of cybersecurity in national security.

1

🔎Enhancing Encryption🔎 CISA just released new guidance to aid federal civilian executive branch (FCEB) agencies in implementing encrypted Domain Name System protocols to bolster their cybersecurity. ❌ This move aligns with the Office of Management and Budget Memorandum M-22-09 and the principles of the National Cybersecurity Strategy towards adopting a zero-trust framework. The latest guidance from CISA provides comprehensive directives on encrypting DNS traffic to enhance confidentiality, integrity, and authenticity, which are crucial for securing the networks of critical federal infrastructures against evolving cyber threats. To view and download a full copy of the paper, check out the link here 👉 https://buff.ly/4bmdyhZ 📡 Steps for implementation are detailed, addressing various aspects of DNS encryption across agency networks, including on-premises, cloud, and mobile environments. It emphasizes the use of CISA’s Protective DNS service as a primary DNS provider and outlines procedures to configure agency and roaming endpoints to prevent communication with unauthorized DNS providers. This framework also includes a phased implementation approach and an implementation checklist to facilitate the transition to encrypted DNS, ensuring agencies meet the encryption requirements while considering the current capabilities of existing infrastructure and vendor landscapes. 🛡️ The structured approach outlined in this guidance aims to significantly enhance the cyber resilience of federal networks by ensuring that all DNS requests are securely handled and authenticated. ❓ What best practices and procedures for DNS do you adhere to in your organization? 📣 Share your story with us in the comments below and tag a friend to hear their take! #CISA #DNS #FCEB #OMB #cyberthreats #zerotrust #framework #criticalinfrastructure #cyberresilience #unauthorizedaccess #federalnetworks #authentication https://buff.ly/4dNPWo6

3

One of the reasons I'm excited about attending the @IPTC Photo-Metadata Conference this year is that I'm really looking forward to hearing a presentation by Neal Krawetz. Neal will be presenting a live demo of research he has gathered over the past year of how the C2PA tools (for provenance and authenticity) still have some holes in their processes. I am all about supporting missions around trust and authenticity in media - but I want to make sure I can see how to get from point A to point Z with transparency, independent governance of data and without it turning into something like digital rights management (DRM) which could lead to silos or channels of content that would only promote or allow only certain publishers to get certificates and be their own verified sources of trust. I keep wanting to use a 'right to repair' your own equipment metaphor, but what I really mean is that I want the 'right to update my own metadata' without having to go through a complex trust and authenticity system that could be hacked anyway but at the same time become the voice of authority.

1

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

Expert analysis by Drew Schmitt, Practice Lead, GRIT at GuidePoint Security, on the evolution of #RaaS. With #ransomware groups adapting recruitment tactics, the cyber threat dynamic changes. Schmitt's investigation uncovers new affiliate strategies after #OperationCronos. Learn more in his interview with Help Net Security. https://okt.to/K0ecpO #CyberCrime

4

This is technically the right approach but converging software factories on to a single DevSecOps platform for programs that are in mature development and fielding is going to be a lot of retrofitting that is not trivial. An open standards and open architecture approach for interoperability is probably the best bet, but standardize on a common platform all new programs moving forward. Great to see CYBERCOM starting to take their acquisition authorities to the next phase. Our adversaries are not constrained by their acquisition bureaucracies.

34

The Army will terminate its Cyber Situational Understanding initiative in the next year, according to new budget documents. The program will not be scrapped entirely, but "will be realigned to suit the service’s future" as the Army's cyberspace needs continue to evolve. Are you interested in working with other DoD Program Managers to solve shared problems? Does your team collaborate across branches and federal departments? We can help. Learn how Leadership Connect can help https://lnkd.in/e6kYcx2z

1

1 Comment