Kevin Landtroop

Hey, small business defense contractors: Have you read the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements Proposed Rule yet? Let me oversimplify for you: Cybersecurity and Infrastructure Security Agency is adding their name to the list of agencies that businesses across multiple sectors must report cyber incidents to - even if your business is small, and even if the business already has mandatory reporting requirements to their sector agency. Rather than remove barriers, streamline, and "harmonize," government policy continues to get more and more complicated for small business owners. The world wonders why small businesses are resource-strapped and confused about government requirements, but with each layer of new policy, it's really no wonder. ----- Comment period ends June 3, 2024: https://lnkd.in/eRgSn3fk Win-Tech submitted comments to the Federal Register, comments shared below. Check out posts by Jacob Horne, Glenda R. Snodgrass, CCP/CCA, and B. Stephanie Siegmann for analysis on the rule and what it may mean looking forward. #DIB #cybersecurity #smallbusiness

31

11 Comments

Last week I posted on the importance of the continuing development of platform plays and the advancements made in the ASPM space. Although the industry has made great strides, it's still important to hit on some important topics that practitioners need to consider when building their nirvana code and application defense platform of choice.   This week I want to focus on end-to-end pipeline defense. As a chief security officer, I have always felt that multiple and diverse development pipelines with independently managed technology and code repos are a continuing blind spot for us. From code to cloud, there are a host of security considerations that should be acknowledged when focusing on application and code security that should be inclusive of end to end pipeline defense.    Let's start with one of the most continuing issues that we seem to deal with; secrets. Hard coded secrets continue to be the bane of many incident responders. The problem is, there are multiple opportunities within the SDLC that we can prevent this at. When considering your platforms, look for technologies that are capable of remediating at the pre-commit stage, the pre-receive stage, and even at the pull-request stage of development. By having a multi-detection-in-pipeline capability, you significantly reduce the opportunity for misconfiguration and the inappropriate application of secrets in code.   Next let's talk about CI/CD security itself. Have you asked yourself, “Am I sure we are enforcing least privilege?” Or “Do I know what DevOps tools have source control access?”. These are all important elements of how we manage our pipelines and enforce security policies that we attest to for our regulators, customers, and our commitment to our business. Make sure that as you choose your platform that it is inclusive of capabilities to manage, enforce, and report on your policies.   Finally, we have to move beyond historical SDLC security evaluation concepts as the baseline of how we defend our pipelines end to end. Secure code as a component of quality is a given, but we also need to think about the broader issue of code exposure as an anchor point for adversaries to attack and exploit your business. When considering your application and code defense platform options, ensure that they include code leak defense. The technology should autodetect for tool misconfigurations that could allow leaks, provide automated alerting on suspicious code access or patterns, and provide continuous public domain scanning to find your intellectual property and proprietary code in public repositories on an ongoing basis.   With the advancements made today in the ASPM technology market, you don't have to choose multiple tools to give you the umbrella capability necessary to defend your pipeline end to end. Create your checklist and go upgrade your business operations protection from cloud to code tomorrow. #cybersecurity #appsec #codedefense #aspm #secrets #codetocloud Cycode | Complete ASPM

64

4 Comments

I’ve been involved with applied Defense RDT&E for over 20 years (wow that slaps) and been the Principal or Technical Lead on over 100 programs. As a Human Factors / Cognitive Systems expert, I often have the luxury of finding a way to meaningfully contribute to any research program that catches my interest, simply due to the fact that everything (at least that interests me) is aligned to enabling, amplifying, or protecting a human user.  Our new OTA with SOCOM represents the first time in a quite a while where the stars are aligning to provide a perfect opportunity that has a Operator-centric focus, a customer that understands the importance of that focus, the funding and runway to achieve meaningful outcomes, and a Defense-related mission need that is at once salient today, critical for the future, and directly in line with the emerging technologies that interest me most today.  Needless to say, it’s an exciting time for me, and our rapidly growing team of engineers, data scientists, and operational experts, to be challenged with an impactful operational problem to solve. 

25

4 Comments

It’s invigorating to be part of an organization that consistently seeks innovative opportunities to expand cloud access for customers across the Department of Defense. Transitioning to the cloud is not just a technical shift but a foundational change, especially for government agencies with limited IT resources. As HaC Technical Director Korie Seville highlights, it's challenging to start from a "blank slate" cloud environment. Agencies face numerous hurdles, from ensuring robust enterprise network connectivity to configuring essential services and addressing stringent security and compliance requirements. Each step requires careful planning and support. Effective cloud adoption in government necessitates understanding these unique challenges and providing tailored solutions. By doing so, cloud providers and partners can facilitate a smoother, more secure transition for government entities, empowering them to harness the full potential of cloud technology. #CloudAdoption #GovernmentIT #DigitalTransformation #HaC #DISA https://lnkd.in/eWQThesn

23

1 Comment

New Office of Management and Budget guidance to Federal Civilian Executive Branch (FCEB) agencies outlines Cybersecurity priorities to be addressed in FCEB FY26 budget submissions. The guidance emphasizes implementation of the five pillars of the the National Cybersecurity Strategy (NCS): 1) Defend Critical Infrastructure; 2) Disrupt and Dismantle Threat Actors; 3) Shape Market Forces to Drive Security and Resilience; 4) Invest in a Resilient Future; and 5) Forge International Partnerships to Pursue Shared Goals. According the new OMB guidance, "OMB and the Office of the National Cyber Director (ONCD) will jointly review agency responses to these priorities in the FY 2026 Budget submissions, identify potential gaps, and identify potential solutions to those gaps. OMB, in coordination with ONCD, will provide feedback to agencies on whether their submissions adequately address and are consistent with overall cybersecurity strategy and policy, aiding agencies’ multiyear planning through the regular budget process." #cybersecurity #criticalinfrastructureprotection #OMB #fy26 #budget

4

The distance between the Pentagon to the Silicon Valley is getting smaller and smaller 💥 💫 The Big Picture: #Defensetech is on the rise as the world 🌍 becomes more turbulent and tensions are high. 💫 Why it matters: To step up and gain advantage in a crowded field, #VCs are looking for unique strategies, one of them is to hire veterans and ex-DOD officials. 💫 What’s in it for the VCs: Former defense professionals help understanding and analyzing the battlefield problems faster and evaluating the solutions better. 💫 What’s in it for #startups: The time to investment will become shorter and the competition on the good startup will be greater. Anyhow it will help the startups crossing the valley of death and get faster with products. 💫 Challenge to focus: Squeezing the timeline to get a contract from the government. In Israel 🇮🇱 the DDR&D (MAFAT) - Directorate of Defense Research & Development in the Israeli Ministry of Defense is taking measures to improve the process by opening “Green Lane” (David Shaul Attias) for startups and community- Mafat for startups (Dekel Yakobovich🇮🇱) In the US 🇺🇸 the Defense Innovation Unit (DIU) is in charge for accelerating the process and adopt startups. NATO launched NATO DIANA and the NATO Innovation Fund (NIF) Defence and Security Accelerator in the UK 🇬🇧 And so on… 💫 By the numbers: $35bln 💰 were invested in DefenseTech startups in 2023, and over $9bln this year so far. 💫 Dive deeper: TechCrunch, Margaux MacColl, https://lnkd.in/dd-5sxa4 #technology #innovation #dualuse #deeptech

48

1 Comment

When it comes to missions of consequence, we need to leverage the nation's full breadth of talent. The ACCESS Act will enhance the United States' competitive edge against our adversaries. This legislation enables the government to leverage people from nontraditional backgrounds to face the evolving challenges of national security. The prioritization of mission-critical skills over degrees creates a new pipeline of cyber and tech professionals that will help our customers keep pace today and meet the threats of tomorrow.  https://lnkd.in/ey58bd5U

44

🔽 See DoD's input request below 🔽 Time for some of those great ideas batted around on LinkedIn to reach the right people in DoD, particularly how to reach small businesses and non-traditional defense contractors and bring them into the fold early in the design, development, and testing processes. The DoD needs DIB expansion. AI, like it or not, is the next big initiative for DoD and most Federal agencies. DoD needs help to make it happen and leveraging AI is going to be an avenue to get it done.

4

Defense Information Systems Agency's Director of Cybersecurity and Analytics, Brian Hermann, announced that their Thunderdome zero trust architecture will be extended to 60 more sites as part of the DOD's effort to reach their 2027 zero-trust goals. Hermann said these new cybersecurity meassures will also improve data management automation: "We need to have the tools to build the rules so that we can automate those things and be confident that we’re getting what we need out of that". It's amazing to see the strides DISA is making towards their objectives and I agree, this will help with far more than just cybersecurity! Read more: https://lnkd.in/d8xKkR-b #cybersecurity #govcon #disa #automation #dod #nationalsecurity

210

13 Comments

DOD issues class deviation, effective immediately, for its safeguarding covered defense information #cyber rule under DFARS 252.204-7012. This deviation amends the #defense regulation to specifically require compliance with NIST SP 800-171 rev. 2 until the deviation is rescinded. Because the pre-deviation language required compliance with the version of NIST SP 800-171 "in effect at the time the solicitation is issued," the deviation provides needed clarity as contractors not only prepare for DOD's upcoming #CMMC rule but also to avoid a compliance headache when NIST publishes rev 3 to #nist800171. #govcon

4

📡🛡️ "Shaping the Future: MIL-STD-188-165 Modem Standards Update" 🛡️📡 🔗 https://lnkd.in/gV3adMRG 1️⃣ 🖋️ "Request for Industry Insights" 🖋️ The Defense Information Systems Agency (DISA) seeks industry feedback on proposed changes to MIL-STD-188-165, focusing on the interoperability of Super High Frequency (SHF) satellite communications PSK modems. Areas of interest include test parameters for Multiple-Carrier modems, TDMA, FHSS, and DSSS, as well as Positive Control data points. 2️⃣ 🔍 "Scope and Technical Challenges" 🔍 This RFI aims to gather information for planning purposes without committing the U.S. Government to any contracts. The evolving capabilities of modems necessitate adjustments to current standards, with MIL-STD-188-165B/C1 serving as a foundation while further investigations continue to ensure relevant and useful requirements. 3️⃣ 📅 "Industry Day Discussions" 📅 Industry participants are encouraged to submit responses by 12 July 2024 and attend the Industry Day meetings from 5th to 9th August 2024 in Colorado Springs, CO. These sessions will facilitate detailed discussions on MIL-STD-188-165 and MIL-STD-188-164, with a specific agenda to be released based on industry feedback. Shape the next generation of satellite communications by participating! #MILSTD188 #SatelliteComms #DefenseTech #IndustryFeedback #DISA #ModemStandards #TechInnovation @DISA_STG @IndustryCollaborate

6

We’re in the middle of a “pencils up, heads down” moment for U.S. industry on #AUKUS.   Strategically, is #AUKUS a security partnership or an industrial partnership? It’s both. It’s a security partnership built on an industrial partnership. By and large, the security partnership has been agreed upon, but it’s the industrial partnership that will drive #AUKUS’ success. The strength and vitality of the security partnership depends on the development of the rules of the road governing the industrial partnership.   On May 1, the U.S. Department of State, the Australian Department of Defence, and the UK Department for Business and Trade released three separate proposals modifying the export control systems in all three counties to implement the partnership. For the U.S., the May 1 proposal was focused on the International Traffic in Arms Regulation (ITAR).   U.S. State Department ITAR proposal: https://shorturl.at/4OaKk Australia Defence Department proposal: https://shorturl.at/MeeLM UK Business and Trade Department proposal: https://shorturl.at/qM1Ut   This was the second regulatory proposal on #AUKUS export controls for the U.S., as the Bureau of Industry and Security-U.S. Department of Commerce released an earlier proposal modifying the Export Administration Regulations (EAR) for the UK and Australia.   U.S. Commerce Department EAR proposal: https://shorturl.at/fUzcT   When Congress passed the FY24 National Defense Authorization Act amending the Arms Export Control Act (AECA), it authorized an #ITAR exemption for the UK and Australia under #AUKUS. State Department’s #ITAR proposal is the implementation of that legislation.   All three countries are seeking feedback on their proposed regulations. For U.S. industry, the focus is on the #ITAR changes, and the analysis of those changes is occurring at a break-neck pace to meet the May 31 deadline.   Some early observations on the U.S. proposal:   1. Clarifying questions from U.S. industry on the proposal will be a significant feedback response. That will necessitate - and require - a running dialogue with industry experts before the rule goes final over the next few months.   2. There are parts of the proposed rule that are operationally impracticable and make sustainment, repair, servicing, and other in-theater/warfighting needs harder. Expect comments and examples along these lines.   3. The Excluded Technologies List (#ETL) will be a major focus of U.S. industry’s feedback, especially in areas where the advanced technology sharing envisioned by the security partnership (Pillar II) may be limited.   4. The Technology Security and Foreign Disclosure (#TSFD) process and how it relates to the licensing process – and the Congressionally-mandated timelines – will be a major source of questions and feedback. There's much work to be done on #TSFD.   Like I said – “pencils up, heads down” moment for industry and the Aerospace Industries Association. There’s much more to come. Watch this space.

232

10 Comments

As an expert in Cybersecurity I’m headlining this conference!

2

1 Comment

The CIRCIA proposed rule will impact defense contractors and subs with additional cyber incident reporting requirements beyond DFARS 7012. Did anybody else notice that the DIB makes up by far the most number of entities affected and represents the largest amount of costs incurred? 𝟮𝟯% 𝗼𝗳 𝗮𝗹𝗹 𝗮𝗳𝗳𝗲𝗰𝘁𝗲𝗱 𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀 𝟭𝟲% 𝗼𝗳 𝘁𝗼𝘁𝗮𝗹 𝗽𝗿𝗼𝗴𝗿𝗮𝗺 𝗰𝗼𝘀𝘁𝘀 On top of that, 𝟵𝟴% 𝗼𝗳 𝗮𝗹𝗹 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀 𝗮𝗿𝗲 𝘀𝗺𝗮𝗹𝗹 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀𝗲𝘀 At what point is the CIRCIA rule really just a Department of Defense small business cyber rule? According to the rule CISA is gonna try super duper hard to cooperate with the DoD in order to establish a "CIRCIA Agreement" to reduce duplicative reporting requirements. I don't know if you're holding your breath but I'm not. Luckily the rule has this tidbit: 𝗔𝘀𝘀𝗶𝘀𝘁𝗮𝗻𝗰𝗲 𝗳𝗼𝗿 𝗦𝗺𝗮𝗹𝗹 𝗘𝗻𝘁𝗶𝘁𝗶𝗲𝘀 "CISA wants to assist small entities in understanding this proposed rule so that they can better evaluate its effects on them and participate in the rulemaking. If this proposed rule would affect your small business, organization, or governmental jurisdiction and you have questions concerning its provisions or options for compliance," please contact: Todd Klessman, CIRCIA Rulemaking Team Lead, CISA circia@cisa[.]dhs[.]gov 202-964-6869 What's the over/under on the number of voicemails left by DoD so far?

45

32 Comments

Over the past 2 months we have seen the DoD move toward the adoption of the Cybersecurity Framework (CSF) for the Defense Industry Base, as part of the DoD DIB cyber strategy, and clearer oversight of their implementation of the Risk Management Framework (RMF), DoDi 8510.01 and DoDi 5000.90. As cyber regulation in the U.S and EU aligns around cybersecurity risk management, the U.S National and international DIB will be affected by both the focus the DoD is placing on the CSF and RMF for the management of cybersecurity based upon risk. Thaddeus Dziekanowski and Brian D. McCarthy the DoD, DIB and the boards of covered entities require a greater understanding of the RMF (NIST SP 800-37), FISMA, the CSF 2.0 and associated DoDIs. The papers we wrote in 2021 are useful reminded of the challenges for the DIB.(https://lnkd.in/dVdM3ZRq) Bob Dix Veritas GRC United States Department of Defense #cybersecurity #cyberriskmanagement

13

Wondering what we've been up to? Please check out the Defense Innovation Unit (DIU) and NSIN - National Security Innovation Network's FY 2023 Annual Reports! Highlights from the DIU Annual Report include: > The arrival of Doug Beck as Director, and the elevation of DIU to a direct report of the Secretary of Defense > A total value of $502.2M in prototype OT contracts awarded > A total of 10 technologies transitioned to a DoD end-user https://www.diu.mil/fy23 Highlights from the NSIN Annual Report include: > Engaging 10,230 new people in the National Security Innovation Base. > Companies in NSIN programs raised $10.8B in private capital funding and $9.9B in DoD funding since 2016. > Helped develop 2,212 unique solutions to national security challenges. https://lnkd.in/eKjKaEJX

26

1 Comment

Are you in the #military? Want to do Operational Planning in one tenth the time? Come check out the Operational Planner chatbot. Any organization interested in a competition to identify the 100x staff officer using the tool? The Digital Insurgency is going to run the following webinars. If you want your own presentation for you or your organization: 1. How to build out an operational design and scenarios in 15 minutes. 2. How do you capture lessons learnt through recording discussions and incorporate them into a pre-after action review. 3. How do write out a warning order in 15 minutes. https://lnkd.in/ebStQt7f

41

7 Comments