Dr. Matthew McFadden

Expert analysis by Drew Schmitt, Practice Lead, GRIT at GuidePoint Security, on the evolution of #RaaS. With #ransomware groups adapting recruitment tactics, the cyber threat dynamic changes. Schmitt's investigation uncovers new affiliate strategies after #OperationCronos. Learn more in his interview with Help Net Security. https://okt.to/K0ecpO #CyberCrime

4

Key considerations on ZT overlays; - rethink the perimeter - multiple attributes , multiple verifications #zerotrust #security

26

5 Comments

One of the reasons I'm excited about attending the @IPTC Photo-Metadata Conference this year is that I'm really looking forward to hearing a presentation by Neal Krawetz. Neal will be presenting a live demo of research he has gathered over the past year of how the C2PA tools (for provenance and authenticity) still have some holes in their processes. I am all about supporting missions around trust and authenticity in media - but I want to make sure I can see how to get from point A to point Z with transparency, independent governance of data and without it turning into something like digital rights management (DRM) which could lead to silos or channels of content that would only promote or allow only certain publishers to get certificates and be their own verified sources of trust. I keep wanting to use a 'right to repair' your own equipment metaphor, but what I really mean is that I want the 'right to update my own metadata' without having to go through a complex trust and authenticity system that could be hacked anyway but at the same time become the voice of authority.

1

𝗕𝗼𝗹𝗱 𝗽𝗿𝗲𝗱𝗶𝗰𝘁𝗶𝗼𝗻 𝘁𝗶𝗺𝗲: 𝗖𝗠𝗠𝗖 𝗿𝘂𝗹𝗲𝗺𝗮𝗸𝗶𝗻𝗴 𝗲𝗱𝗶𝘁𝗶𝗼𝗻 - 𝗧𝗵𝗲 𝟯𝟮 𝗖𝗙𝗥 𝗖𝗠𝗠𝗖 𝗳𝗶𝗻𝗮𝗹 𝗿𝘂𝗹𝗲 𝘄𝗶𝗹𝗹 𝗯𝗲 𝗽𝘂𝗯𝗹𝗶𝘀𝗵𝗲𝗱 𝗯𝘆 𝘁𝗵𝗲 𝗲𝗻𝗱 𝗼𝗳 𝟮𝟬𝟮𝟰 - 𝗧𝗵𝗲 𝟰𝟴 𝗖𝗙𝗥 𝗖𝗠𝗠𝗖 𝗳𝗶𝗻𝗮𝗹 𝗿𝘂𝗹𝗲 𝘄𝗶𝗹𝗹 𝗯𝗲 𝗽𝘂𝗯𝗹𝗶𝘀𝗵𝗲𝗱 𝗮𝘁 𝘁𝗵𝗲 𝗲𝗻𝗱 𝗼𝗳 𝟮𝟬𝟮𝟱 This matters because DoD's "phased roll-out" for CMMC in contracts starts with the 48 CFR final rule revising DFARS clause 252.204-7021 to match the program details codified by the 32 CFR CMMC final rule. However, once the CMMC program is live thanks to the 32 CFR final rule, all bets are off: anyone can pay for an official CMMC assessment at that point. This means that the "market roll-out" will start long before DoD contractually requires anyone to have a certification and there's nothing DoD can really do about it. The most recent DFARS open cases report shows that the 48 CFR rule is bouncing around for revisions inside DoD which will add tons of time to before it's published even as a proposed rule. Competition and prime contractor questionnaires will drive a stampede of companies desperate for certification assessments while DoD scribbles away.

76

13 Comments

🚀 Enhancing Cybersecurity with LogicFinder’s Solutions! 🚀 We're excited to spotlight our ASSIST Tool Development project for the DoD. This tool enhances data analysis, processing, and utilization, empowering DoD personnel with critical insights for informed decisions and operational superiority. 🔗 Learn more: www.logicfinder.net 📧 Contact us: info@logicfinder.net #CyberSecurity #Innovation #Technology #DoD #Defense #DataAnalysis #IntelligenceSolutions #TechInnovation #OperationalExcellence #SupportTools #AI #MachineLearning #BigData #DataScience #InformationSecurity #CyberDefense #TechSolutions #ITConsulting #SecureTech #AdvancedTechnologies #MilitarySupport #DataProcessing #CuttingEdgeTech #TechDevelopment #LogicFinder #TechIndustry #DigitalTransformation #DataInsights #DoDSolutions #MissionCritical #NationalSecurity

5

The Department of Defense released a 400-page document, "Zero Trust Overlays," which details one overlay for each of the seven pillars in the DoD Zero Trust Strategy, plus an overlay for the enablers. Learn more about this new guidance. https://bit.ly/4cb3XKU

12

Automated Continuous Assessments are the only way forward if we want to keep pace. Point in time assessments can’t provide the necessary assurance and significantly delay mission access to leading tech. It’s the same issue in Commercial and Jeff Buss makes a great point.

62

6 Comments

Good policies/SOPs, smart acquisitions terms and controls, good communications/relationships, and smart continuous monitoring are the recipe to reciprocity.

2

Organizations globally experience the same classification issues, which are highlighted in the US DoD Inspector General report - Janusnet has the solution for the report's key recommendation: “In coordination with the Office of the DoD Chief Information Officer and DoD Component Heads, develop and implement a DoD‑wide solution for automatically populating documents and emails with the required markings based on a set of selection criteria.” Janusnet enables organizations to mark #CUI and implement the requirements of the United States Department of Defense CUI program

9

Certainly a step in the right direction! I'm sure Gen. Nakasone's leadership at U.S. Cyber Command and the NSA will provide invaluable perspectives to strengthen AI defense strategies. Thoughts? #CyberSecurity #AI #NationalSecurity #OpenAI

6

The badge is here! Quick Description: "Participants are given a series of real-world challenges that represent the skillsets most in-demand by the DoD. These challenges are designed to measure an individual's technical, analytical, and strategic abilities in the following skills categories: Forensics, Malware/ Reverse Engineering, Networking & Reconnaissance, Open-Source Intelligence Gathering (OSINT) and Web Security."

18

This is technically the right approach but converging software factories on to a single DevSecOps platform for programs that are in mature development and fielding is going to be a lot of retrofitting that is not trivial. An open standards and open architecture approach for interoperability is probably the best bet, but standardize on a common platform all new programs moving forward. Great to see CYBERCOM starting to take their acquisition authorities to the next phase. Our adversaries are not constrained by their acquisition bureaucracies.

34

For those who missed my presentation at CMMC Day, a summary: There are two CMMC rules on two different rulemaking timelines that will lead to one giant gap between when DoD says you need CMMC and when the market says you need CMMC. The background info: The first rule codifies the CMMC program (the three levels, POAMs, waivers, roles and responsibilities, etc.). - This rule is the "32 CFR CMMC" rule. - Once this rule is final and effective, the CMMC marketplace is live (something I call the "market roll-out"). - That means your customers and your competitors will immediately pressure you to get certified. The second rule revises the DFARS clause 252.204-7021 created by the 2020 CMMC rule to match the details of the program at 32 CFR. - This rule is the "48 CFR CMMC" rule. - Once this rule is final and effective, DoD will begin inserting CMMC level requirements pursuant to the DFARS 7021 clause in contracts in phases. - Hence the name "phased roll-out". The 32 CFR CMMC rule was published just after Christmas 2023. Normally DoD rules take ~280 business days after publication to adjudicate public comments and publish a final rule. This puts the window for a 32 CFR CMMC final rule ~Q1 2025. However, DoD and OMB are highly motivated to wrap up rulemaking before the election adds time to the miscellaneous red tape that occurs when a final rule is published. There are many reasons to believe that DoD will beat the average timeline by a few months and meet their goal (for the sake of space, comment below if you'd like to know what those reasons are). In parallel, the 48 CFR CMMC proposed rule was originally slated for Q1 2024 publication with a Q1 2025 final rule. Unfortunately, the 48 CFR rule is behind schedule and was recently sent back for revisions which could add weeks/months before the proposed rule is published. If the average timeline applies to the 48 CFR rule once published in Q4 2024, then the gap between the two rules could be upwards of a year, possibly longer. As a result, all of the chaos resulting from CMMC will set-in by Q1 2025 but DoD will be able to say "we haven't required CMMC in a single contract yet".

163

19 Comments

Do you find the false dichotomy between compliance and security to be loathsome, circular, and unhelpful? Are you curious about what security value you're getting for your time, money, and effort when you pursue CMMC certification? Catch the replay of my presentation at CS2 Boston on May 7th at 10am Central (it's free) I'll be answering questions live in chat so come hang out Registration link is in the comments below 👇

65

8 Comments

Nothing to see here folks. Just the promotion of the gentleman who wrote a WaPo op-ed in support of renewing Section 702 of the Foreign Intelligence Surveillance Act (FISA). You know, that thing that BOTH side of the aisle were concerned about, which Sen. Ron Wyden (D-OR) called "one of the most dramatic and terrifying expansions of government surveillance authority in history." Yeah, he's on the Board of OpenAI now. As The Verge notes; "Recent departures tied to safety at OpenAI include co-founder and chief scientist Ilya Sutskever, who played a key role in Sam Altman’s November firing and eventual un-firing, and Jan Leike, who said on X that “safety culture and processes have taken a backseat to shiny products.”" I'm sure glad the NSA (fka OpenAI) will have a direct presence on my iPhone now. OG Article: https://lnkd.in/g8EP8YpR #lol #NSA #openai #ai #llm #security #goverment #policy #ethics #ethicsconflict https://lnkd.in/g8EP8YpR

6

1 Comment

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

As I have been learning more about the ISSO role and the importance of the RMF process and continuous ATO, I've got to say this "In a Box" tool is incredibly useful. If I were the ISSO at an organization, I would definitely rely on this heavily. #cybersecurity #continuousATO #RMF #zerotrust #thinksmarternotharder

6

Check out this article in Federal News Network, where SkillStorm Advisory Board Chair Suzette Kent discusses the critical need for cyber & cloud skills within the federal government. It is clear that a skills-based hiring approach (vs. rigid four-year degree requirements) is necessary to help close the tech skills gap while enabling the government and contractors to close the tech skills gap and keep the US on the cutting edge of technology. https://lnkd.in/g6pU95uR

20