Peter Nguyen, CISSP, MCT, CDPSE

🗞️ In CyberScoop: "[T]he years of work to build up federal collaboration with industry are paying off, from the Joint Cyber Defense Collaborative to the National Risk Management Center — the 'proto' version of the JCDC, [Chris Krebs] said — to the National Security Agency’s Cybersecurity Collaboration Center. "'We’re starting to see that these things work with the resources and time into it, but it’s generating results and there’s no better evidence of the results, I think, than when Russia invaded Ukraine, and the ‘Shields Up’ campaign and the breadth to which that was able to change behavior in industry,' said Krebs, now chief intelligence and public policy officer at SentinelOne." To learn more, read the full article by Tim Starks: https://s1.ai/CS-Collab

43

"The selection of security controls for DoD’s implementation of zero trust across the enterprise is based on DoD’s Zero Trust Reference Architecture, along with the DoD’s Zero Trust Strategic Principles and Tenets." https://lnkd.in/gwxqWpts #dod #cybersecurity #zerottrust #informationsecurity #defenseindustrialbase #industrialcyber #icssecurity #ics

2

Regulations, Frameworks, Best Practices, so it goes on. We've seen Emergency Directives, Executive Orders and still, by far the weakest link is a fundamental lacking of basic security discipline,managment, and seemingly knowledge. AI WILL NOT SOLVE THIS PROBLEM, IT WILL SIMPLY COMPOUND AND EXACERBATE THE EXPOSED AND INSECURE DIGITAL WORLD. Whilst we see a global spend of around $300 billion annually on cyber security, we witness that in costs and losses to cybercrime weekly. Think about that for a moment then read 'Best Practice.' One day soon we will look back and say, Do you remember when cyber crime was only a $trillion a month? Now look at the situation...That day is not too far away and the $300 billion spend currently is largely wasted. Sure the Agencies want you to be informed, made aware, even warned, but only just enough so. It provides a level of Plausible Deniability. How good is a Doctor who incorrectly prescribes a medicine to a condition caused by the medicine their patient ingests... The Agencies and Governments DO NOT WANT the world to know that the Digital Advantages they saught and continually seek, due to their own security failings, have become the Blueprint for Cybercrime. That would place a whole load of liabilities on their doorstep. So the choreographed dance continues along with Digital Whack-a-Mole and Insecurity Entrapment. Be warned, the Music is slowing down and in true Titanic fashion, there is a distinct shortage of seats... AI like most technology is being better utilized and deployed by criminals to disrupt, cause chaos, and for crime. Jen Easterly, Chris Wray, Paul Nakasone and many others keep warning us of the China crisis and Russian cyberwars, but do little to truly arm and protect by a lack of openess and honesty. That's spying for you I guess... The mindest remains Data Capture and Data Control. Security is barely on the agenda. Ask CISA how their Emergency Directive M-19-01 on DNS Tampering and Abuse is going 5 years on. Or I can simply tell you, not one Federal Agency has secure DNS records and servers. Facts can be stubborn things. Best Practice, Frameworks, and impotent Regulations DO NOT get the job done. Time is running out for us to have anything left that is not controlled, or owned by adversaries including Critical Infrastructure, Hospitals, Universities, Law Enforcement, and Governments. Immaterial of any religion you may or may not have, a greater power looking down would mark the last several decades and overall security capability with a rather large red capital F... #WhitethornShield Federal Bureau of Investigation (FBI) FBI Cyber Division The White House White House Presidential Innovation Fellows United States Air Force National Security Agency United States Attorneys'​ Offices U.S. Department of Justice #InternetSecurity #DNS #PKI CISA Alumni Group

30

14 Comments

FOR RELEASE MAY 29, 2024 Leviathan Security Group Joins InfraGard National’s Cyber Readiness and Resilience Initiative to Protect U.S. Critical Infrastructure   SEATTLE, WA – MAY 29, 2024 – Leviathan Security Group, a provider of mission-critical cybersecurity solutions, is proud to announce its sponsorship of InfraGard National Members Alliance (INMA), an FBI-affiliated independent nonprofit organization dedicated to protecting U.S. critical infrastructure. As a gold sponsor, Leviathan joins InfraGard National’s Cyber Readiness and Resilience initiative and will collaborate on educational programs that provide cybersecurity stakeholders with knowledge and resources to secure our nation’s most critical assets.   Cyberattacks on critical infrastructure present a significant national security threat and strategic risk to the United States. On an unprecedented scale, nation-state actors and cyber criminals are attempting to disrupt the assets, systems and networks that underpin American life. Cyber Readiness and Resilience is a content-focused initiative that will include eLearning programs and webinars, conference workshops, podcasts, and social media campaigns on a variety of timely topics, including ransomware, business email compromise, theft of trade secrets, and nation-state attacks. Through education and training, Cyber Readiness and Resilience will provide security stakeholders with knowledge and resources to secure our nation’s most critical assets.   "We are excited to join forces with InfraGard National Members Alliance and contribute to their efforts in critical infrastructure protection," said Matt Harrigan, Vice President, Business Development, Leviathan Security Group. “Leviathan recognizes the importance of collaboration and information sharing in safeguarding our nation against emerging threats. Through our partnership, we aim to advance cybersecurity best practices and contribute to the collective defense of our nation's infrastructure.”   “Our Cyber Readiness and Resilience initiative is all about building a coalition to address this unprecedented era of cyber threats,” said Doug Farber, Chairman, InfraGard National Members Alliance. “Leviathan has helped some of the world’s largest companies execute their security vision, making them an ideal partner. We are grateful for their leadership, support and philanthropy as we tackle the cybersecurity challenges of today and beyond.”    About Leviathan Security Group Since 2006, Leviathan Security Group has been a leading provider of mission- critical cybersecurity solutions to the modern enterprise. With a focus on penetration testing, risk advisory, red team, and hardware security, we empower our customers to operate safely and securely, knowing that their technology, networks, and businesses have been vetted by some of the industry’s top talent. For more information about Leviathan Security Group and our commitment to cybersecurity, please visit https://lnkd.in/gpWND3kx

25

1 Comment

Here is some food for thought for Defense Industrial Base (DIB) companies that need to prepare for their CMMC certification and protect the performance, resilience, and trust of their primes and the DoD. By effectively leveraging the NIST Cybersecurity Framework, DIB companies can strengthen their cyber risk management posture and achieve CMMC certification. This strategic approach enhances the protection of sensitive information and establishes a culture capable of mitigating cyber risks to protect digital business performance, resilience, and trust with customers and partners.

5

Prime contractors are urgently asking subs: When do you plan to get your #CMMC Level 2 Certification? The time to act is now. 👉 Reserve your spot for the early CMMC Certification Assessment today. 💡 𝗪𝗵𝘆 𝗻𝗼𝘄? ☝ - When #DoD includes CMMC Level 2 Certification requirements in a contract, 𝘿𝙤𝘿 𝙚𝙭𝙥𝙚𝙘𝙩𝙨 𝙘𝙤𝙣𝙩𝙧𝙖𝙘𝙩𝙤𝙧𝙨 𝙩𝙤 𝙤𝙗𝙩𝙖𝙞𝙣 𝙩𝙝𝙚 𝘾𝙈𝙈𝘾 𝘾𝙚𝙧𝙩𝙞𝙛𝙞𝙘𝙖𝙩𝙞𝙤𝙣 𝙗𝙮 𝙩𝙝𝙚 𝙘𝙤𝙣𝙩𝙧𝙖𝙘𝙩 𝙖𝙬𝙖𝙧𝙙 𝙙𝙖𝙩𝙚. This includes subcontractors. ✌ - Avoid the mad rush! - Thousands of Defense contractors (Prime and Subs) will need to get the CMMC certification, while there are only 54 C3PAOs. ⏰ Based on the #CMMC rulemaking schedule, the CMMC Certification Assessment will start by the end of 2024 or the beginning of 2025. ✔ As the Joint Surveillance Voluntary Assessment (#JSVA) window closes, more #DIB organizations have reserved their spots in the queue. ❗ Act fast. We are taking reservations now. klcconsulting.net/contact KLC Consulting - Authorized CMMC C3PAO

12

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

⚙️ PRC Hackers Escalate Attacks on Critical Infrastructure: Insights from SANS Experts Security expert Rob T. Lee warned CBS News Chicago that cyberattacks on our water and utility systems could have profound impacts. He provided a detailed look at what such attacks might entail in the future. "Cyber attack is a great levying capability against any nation-state. This could be just an ever-increasing way to let the nation's utilities take even greater notice that they are doing everything possible to prevent any kind of cyber attack." - Rob T. Lee 🔗 For more details, watch the full report → https://lnkd.in/eygq9Nin SANS ICS | #ICSSecurity #OTSecurity #CyberAttacks

8

1 Comment

⚙️ PRC Hackers Escalate Attacks on Critical Infrastructure: Insights from SANS Experts Security expert Rob T. Lee warned CBS News Chicago that cyberattacks on our water and utility systems could have profound impacts. He provided a detailed look at what such attacks might entail in the future. "Cyber attack is a great levying capability against any nation-state. This could be just an ever-increasing way to let the nation's utilities take even greater notice that they are doing everything possible to prevent any kind of cyber attack." - Rob T. Lee 🔗 For more details, watch the full report → https://lnkd.in/eygq9Nin SANS Institute | #ICSSecurity #OTSecurity #CyberAttacks

20

2 Comments

"Many of the controls included in the overlays will be implemented at the organizational or DoD enterprise level and inherited by each of the systems, following guidance in the DoD Zero Trust Reference Architecture, and DoD Component architectures, including Security and Privacy Architectures." https://lnkd.in/gwxqWpts #dod #cybersecurity #zerottrust #informationsecurity #defenseindustrialbase #industrialcyber #icssecurity #ics

2

CMMC - Clean-up in Isle 7, There is a consistent mess in Isle 7. Only if you have had an actual CCA perform a Mock Assessment will an OSC/OSA (Organization Seeking Certification / OSA - Organization Seeking Assessment) know what an assessment requires. (14 policies; 8 plans, 320 Assessment Objectives, 280 Artifacts) You think you are ready for your final Assessment by a C3PAO for CMMC Compliance? You're not! The CMMC Certification Process: 1. You have gone thru your Self-Assessment. (With Expert guidance) 2. Created and entered your score into the SPRS system. 3. You did a "Readiness" Project which kicked out a Gap Analysis and a POA&M. 4. You have a central library (GRC Service? Spreadsheets?) of artifacts as evidence of compliance. All assembled over many months by different contributors. (Guaranteed there is a lack of conformity.) 5. You remediated and documented everything from the POA&M. 6. Your Policies, Procedures and Evidence documents are all ready, and in order? 7. You think you are in a ready state for an Assessor to breeze through all the evidence and certify you. You schedule a C3PAO for your Assessment. 8. The Assessor will review, find issues for remediation ie: gaps. 9. Back to remediation 10. Reschedule the final Assessment 11. Rinse repeat until you are fully compliant. WHAT IF WE COULD SHORTEN THIS PROCESS AND SAVE TIME ($) AND EFFORT? DoD estimates CMMC paperwork burden at 525 hours https://lnkd.in/g48JBDEb Insert step 7.1 - Run a Mock Assessment by a CCA using an AI Based Documentation review Service that produces a POA&M that addresses the integrity of your Artifacts and Evidence in less than a week. Insert step 7.2 Remediate from POA&M items. Insert step 7.3 Re-run the Service for final readiness status. WHY? - To confirm your readiness. - To present a more palatable set of documentation to the C3PAO and accelerate Certification. - To Save countless manhours in the journey to certification. - To help streamline steps 8, 9, 10, and 11 above. NOTE: The Service will generate an immediate ROI. Improve your chances of 1st time certification by working with Gailey Solutions. Get actionable results in days, not weeks. Call Gailey Solutions for CMMC help and guidance. NOTE: We White Label this Service to Partners in the CMMC Community to help you guide your clients thru the Process.

1

Episode 3039 - Billions are spent annually on security solutions, yet ransomware sieges continue to escalate. Will AI change the game in favor of attackers or defenders? How does encryption work, and does it introduce overhead into the mass management of enterprise endpoints? Brett H. Chief Growth Officer at Cigent Technology, Inc. answers these questions and more in this Post-RVAC Briefing. Maureen McGregor and Lindsay T., Thank you! #cybersec #cybersecurity #disruptive #innovation #encryption #endpointdataprotection #cigent # Watch the briefing here: https://lnkd.in/guDbDDQr

1

Download ControlCase's CMMC 2.0 Compliance Checklist to learn about safeguarding FCI and CUI through CMMC 2.0. https://hubs.li/Q02zPLvt0 #ControlCase #CMMC2 #FCI #CUI

6