Chris H.

At Kieri Solutions - Authorized C3PAO , we are getting questions from our clients about whether Chevron could mean that CMMC is going away. With the caveat that I'm not a lawyer... The short answer is no. The portion of CMMC that impacts defense contractors is the 𝘤𝘰𝘯𝘵𝘳𝘢𝘤𝘵 𝘤𝘭𝘢𝘶𝘴𝘦 which states essentially "𝐈𝐧 𝐫𝐞𝐭𝐮𝐫𝐧 𝐟𝐨𝐫 𝐭𝐡𝐞 𝐃𝐨𝐃 𝐩𝐚𝐲𝐢𝐧𝐠 𝐦𝐞 𝐦𝐚𝐝 𝐦𝐨𝐧𝐞𝐲, 𝐈 𝐭𝐡𝐞 𝐝𝐞𝐟𝐞𝐧𝐬𝐞 𝐜𝐨𝐧𝐭𝐫𝐚𝐜𝐭𝐨𝐫 𝐚𝐠𝐫𝐞𝐞 𝐭𝐨 𝐩𝐚𝐬𝐬 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐬𝐞𝐥𝐟-𝐚𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭𝐬 𝐚𝐧𝐝 𝐭𝐡𝐢𝐫𝐝-𝐩𝐚𝐫𝐭𝐲 𝐚𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭𝐬 𝐚𝐭 𝐋𝐞𝐯𝐞𝐥 1 / 2 / 3, 𝐢𝐧 𝐚𝐝𝐝𝐢𝐭𝐢𝐨𝐧 𝐭𝐨 𝐩𝐫𝐨𝐯𝐢𝐝𝐢𝐧𝐠 𝐭𝐡𝐞 𝐩𝐚𝐫𝐭/𝐬𝐞𝐫𝐯𝐢𝐜𝐞/𝐜𝐚𝐩𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐭𝐡𝐚𝐭 𝐢𝐬 𝐦𝐲 𝐩𝐫𝐢𝐦𝐚𝐫𝐲 𝐛𝐮𝐬𝐢𝐧𝐞𝐬𝐬 𝐟𝐮𝐧𝐜𝐭𝐢𝐨𝐧." This is a 𝐯𝐨𝐥𝐮𝐧𝐭𝐚𝐫𝐲 contract clause. It isn't being imposed upon you. The clause will be added to new, renewing, and option year contracts, almost certainly starting in early 2025. If companies want to make money selling to the DoD, they will need to accept the contract clauses. This is what the DoD CIO's office has been saying for 5 years now. At 𝘸𝘰𝘳𝘴𝘵, I think Chevron could invalidate portions of the CMMC guidance that is published separately from the CMMC Rule. Such as the DFARS Cyber FAQ, or the FedRAMP Equivalency Memo. But did you notice that the CMMC rule is hundreds of pages long, even including the full text of the CMMC Assessment Guides? That means that everything that is currently in the rule is immune, as soon as the defense contractor signs that contract clause. So again, no. #CMMC isn't going away. Unless the defense contractor decides they no longer want to make money from the Department of Defense. Please see the real lawyer's perspective below. Jacob Horne, is this how you read it too?

46

18 Comments

🚨 DFARS 252.204-7021 (the CMMC clause) is currently at the Office of Management and Budget (OMB) 🚨 The abstract states, "DoD is amending an interim rule to implement the CMMC framework 2.0 in order to protect against the theft of intellectual property and sensitive information from the Defense Industrial Base (DIB) sector. The CMMC framework, as defined in Title 32 of the Code of Federal Regulations (CFR), assesses compliance with applicable information security requirements. This rule provides the Department with assurances that a DIB contractor can adequately protect sensitive unclassified information at a level commensurate with the risk, accounting for information flow down to its subcontractors in a multi-tier supply chain." Once approved, the rule will be sent to the Federal Register for publication 👀 You can see the rule here: https://lnkd.in/eyP5dqre Shoutout to Eric Crusius for breaking this news! #cmmc #dod #cybersecurity

35

#OSINT framework focused on gathering information from free tools or resources. The intention is to help people find free OSINT resources. Some of the sites included might require registration or offer more data for $$$, but you should be able to get at least a portion of the available information for no cost. #osintforgood #investigations All credits to-->  Twitter: @jnordine

11

Here I take on the question of what DoD contractors should expect will happen to the present and pending #CMMC cybersecurity rules by reason of the Supreme Court's Loper Bright decision and repeal of the "Chevron doctrine." 1.    Loper Bright does not eliminate the significance of agency rationale in a court’s decision should an agency regulation be challenged. What has changed is that federal courts will no longer be required to follow any “permissible” agency interpretation. Now, courts will determine whether a challenged agency rule is within the scope of underlying statutory authority, and whether an agency’s interpretation is the “best” when a court has applied traditional tools for statutory interpretation. 2.    Cybersecurity types know that much explanation accompanied the Dec. 26, 2023, CMMC Proposed Rule. One possible explanation is that rule drafters may have deliberately provided elaborate explanation, to assist a reviewing court conclude that the agency’s regulations reflect “reasoned decision-making” within the statutory boundaries. 3.     The majority in Loper Bright recognizes that courts may seek aid from the interpretations of those responsible for implementing particular statutes. We can expect federal courts to credit well-reasoned actions of statutory implementation and application. The bottom won’t fall out from present and pending rulemaking. Moreover, agency General Counsels known for some years of the erosion of Chevron. Many pending rules likely were prepared with such a contingency in mind. 4.    DoD's cyber regulations are imposed not by operation of an overarching statute but by contract clauses, e.g., DFARS 252.204-7012, which companies accept when taking certain DoD contracts. FAR rulemaking (inclusive of the DFARS) is not governed by the Administrative Procedures Act (APA). Chevron decided that interpretative deference to federal agencies violated Section 706 of the APA. It is not clear (to me) that any DoD contractor may bring an APA challenge to CMMC rules that builds on the Loper Bright repudiation of Chevron. 5.    An objection to the CMMC rules may be subject exclusively to jurisdiction under the Contract Disputes Act or the Tucker Act, as objections to CMMC duties would arise by reason of DoD contract terms. The Court of Federal Claims may have exclusive jurisdiction. In a 2021 decision, a federal district court found: where a plaintiff's claim is "concerned solely with rights created within the contractual relationship and has nothing to do with duties arising independently of the contract[,] the claim is founded upon a contract with the United States and is therefore within the Tucker Act and subject to its restrictions on relief." This is a complex subject. I welcome different views. However, I think there is no significant risk that the Loper Bright decision will put CMMC DFARS rulemaking at risk of successful APA challenge. (Personal opinion.) Brian Levine Chris Hughes

76

26 Comments

🤔 Well said Help Net Security “The tool excels in distributing software across various secure development settings, including edge and embedded systems, secure clouds, data centers, and local setups.” “Zarf simplifies deployments into a single compressed file containing everything your app needs. It can be installed without an internet connection. Its declarative approach ensures consistent application deployment every time. The tool can also incorporate legacy code into modern DevSecOps environments, facilitating deployment.” https://lnkd.in/eRwgmKwG

57

2 Comments

OMB's Cyber Budget Priorities Memo out: "Agency budget submissions should demonstrate how agencies are reducing risk by increasing maturity of information systems across the pillars outlined in the Cybersecurity and Infrastructure Security Agency’s (CISA) Zero Trust Maturity Model." https://lnkd.in/e2dvJU3k

21

4 Comments

🇨🇳 RED ALERT: 𝑪𝒐𝒖𝒏𝒕𝒆𝒓𝒊𝒏𝒈 𝒕𝒉𝒆 𝑪𝒚𝒃𝒆𝒓𝒕𝒉𝒓𝒆𝒂𝒕 𝒇𝒓𝒐𝒎 𝑪𝒉𝒊𝒏𝒂 - 🏛️ United States House Committee on Oversight and Accountability Subcommittee on Cybersecurity, Information Technology, and Government Innovation. The panel discussion focused on cyber warfare threats, particularly those orchestrated by the 𝑷𝒆𝒐𝒑𝒍𝒆'𝒔 𝑹𝒆𝒑𝒖𝒃𝒍𝒊𝒄 𝒐𝒇 𝑪𝒉𝒊𝒏𝒂 (𝑷𝑹𝑪), against the United States' critical infrastructure. ✅𝗖𝗥𝗜𝗧𝗜𝗖𝗔𝗟 𝗥𝗘𝗖𝗢𝗠𝗠𝗘𝗡𝗗𝗔𝗧𝗜𝗢𝗡𝗦 📍𝗙𝗲𝗱𝗲𝗿𝗮𝗹 𝘀𝘂𝗽𝗽𝗼𝗿𝘁 𝘀𝗵𝗼𝘂𝗹𝗱 𝗯𝗲 𝗶𝗻𝗰𝗿𝗲𝗮𝘀𝗲𝗱 to develop and replace outdated technology in critical infrastructure with secure alternatives. 📍𝗣𝗿𝗼𝗺𝗼𝘁𝗲 𝗮𝗻𝗱 𝗶𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁 President Biden's national cybersecurity strategy. 📍𝗔𝘀𝘀𝗶𝘀𝘁 𝗮𝗹𝗹𝗶𝗲𝘀 in resolving cyber incidents by engaging in *proactive international diplomacy.* 📍𝗜𝗻𝘃𝗲𝘀𝘁 𝗶𝗻 𝗔𝗜 𝗮𝗻𝗱 𝗾𝘂𝗮𝗻𝘁𝘂𝗺 𝗰𝗼𝗺𝗽𝘂𝘁𝗶𝗻𝗴 𝗿𝗲𝘀𝗲𝗮𝗿𝗰𝗵 to improve cyber defenses, recognizing the potential of these technologies to detect and mitigate attacks. 📍𝗣𝗿𝗼𝘃𝗶𝗱𝗲 𝗴𝘂𝗶𝗱𝗮𝗻𝗰𝗲 𝘁𝗼 𝗻𝗼𝗻-𝗳𝗲𝗱𝗲𝗿𝗮𝗹 𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀, clarify protocols, and support victims of cybercrime instead of imposing punishment. 📍𝗖𝗼𝗻𝘀𝗶𝗱𝗲𝗿 𝗿𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗮𝗻𝗱 𝗳𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝘀𝘁𝗿𝗮𝘁𝗲𝗴𝗶𝗲𝘀 to incentivize the removal of obsolete technologies and encourage updated and secure systems. ✅𝗞𝗘𝗬 𝗤𝗨𝗢𝗧𝗘𝗦 𝗙𝗥𝗢𝗠 𝗧𝗛𝗘 𝗛𝗘𝗔𝗥𝗜𝗡𝗚: "𝑇ℎ𝑒𝑠𝑒 𝑎𝑡𝑡𝑎𝑐𝑘𝑠 𝑜𝑛 𝑜𝑢𝑟 𝑐𝑟𝑖𝑡𝑖𝑐𝑎𝑙 𝑖𝑛𝑓𝑟𝑎𝑠𝑡𝑟𝑢𝑐𝑡𝑢𝑟𝑒 𝑎𝑟𝑒 𝑛𝑜𝑡 𝑗𝑢𝑠𝑡 𝑖𝑛𝑐𝑖𝑑𝑒𝑛𝑡𝑠 𝑜𝑓 𝑐𝑦𝑏𝑒𝑟𝑐𝑟𝑖𝑚𝑒 𝑜𝑟 𝑒𝑠𝑝𝑖𝑜𝑛𝑎𝑔𝑒; 𝑡ℎ𝑒𝑦 𝑎𝑟𝑒 𝑑𝑒𝑙𝑖𝑏𝑒𝑟𝑎𝑡𝑒 𝑎𝑛𝑑 𝑐𝑎𝑙𝑐𝑢𝑙𝑎𝑡𝑒𝑑 𝑠𝑡𝑟𝑎𝑡𝑒𝑔𝑖𝑒𝑠 𝑒𝑚𝑝𝑙𝑜𝑦𝑒𝑑 𝑏𝑦 𝑡ℎ𝑒 𝐶ℎ𝑖𝑛𝑒𝑠𝑒 𝑔𝑜𝑣𝑒𝑟𝑛𝑚𝑒𝑛𝑡 𝑎𝑖𝑚𝑒𝑑 𝑎𝑡 𝑑𝑒𝑠𝑡𝑎𝑏𝑖𝑙𝑖𝑧𝑖𝑛𝑔 𝑜𝑢𝑟 𝑐𝑜𝑛𝑓𝑖𝑑𝑒𝑛𝑐𝑒 𝑎𝑛𝑑 𝑤𝑖𝑙𝑙𝑖𝑛𝑔𝑛𝑒𝑠𝑠 𝑡𝑜 ℎ𝑒𝑙𝑝 𝑚𝑎𝑖𝑛𝑡𝑎𝑖𝑛 𝑡ℎ𝑒 𝑝𝑒𝑎𝑐𝑒𝑓𝑢𝑙 𝑤𝑜𝑟𝑙𝑑 𝑜𝑟𝑑𝑒𝑟." ~ Rob Joyce, Former Special Assistant to the President and The White House Cybersecurity Coordinator. "𝐼𝑡 𝑖𝑠 𝑒𝑠𝑡𝑖𝑚𝑎𝑡𝑒𝑑 𝑡ℎ𝑎𝑡 80% 𝑜𝑓 𝐴𝑚𝑒𝑟𝑖𝑐𝑎𝑛 𝑎𝑑𝑢𝑙𝑡𝑠 ℎ𝑎𝑣𝑒 ℎ𝑎𝑑 𝑎𝑙𝑙 𝑜𝑓 𝑡ℎ𝑒𝑖𝑟 𝑝𝑒𝑟𝑠𝑜𝑛𝑎𝑙 𝑑𝑎𝑡𝑎 𝑠𝑡𝑜𝑙𝑒𝑛 𝑏𝑦 𝑡ℎ𝑒 𝐶𝐶𝑃" ~ William Evanina, Former Director of the National Counterintelligence and Security Center. "𝑇ℎ𝑒𝑦 𝑜𝑓𝑡𝑒𝑛 𝑟𝑒𝑠𝑒𝑎𝑟𝑐ℎ 𝑎𝑛𝑑 𝑑𝑒𝑣𝑒𝑙𝑜𝑝 𝑒𝑥𝑝𝑙𝑜𝑖𝑡𝑠 𝑓𝑜𝑟 '𝑧𝑒𝑟𝑜 𝑑𝑎𝑦' 𝑣𝑢𝑙𝑛𝑒𝑟𝑎𝑏𝑖𝑙𝑖𝑡𝑖𝑒𝑠... 𝑂𝑣𝑒𝑟 𝑡ℎ𝑒 𝑝𝑎𝑠𝑡 𝑓𝑒𝑤 𝑦𝑒𝑎𝑟𝑠, 𝑤𝑒’𝑣𝑒 𝑜𝑏𝑠𝑒𝑟𝑣𝑒𝑑 𝑡𝑎𝑟𝑔𝑒𝑡𝑒𝑑 𝑧𝑒𝑟𝑜-𝑑𝑎𝑦 𝑒𝑥𝑝𝑙𝑜𝑖𝑡𝑎𝑡𝑖𝑜𝑛 𝑜𝑓 𝑣𝑢𝑙𝑛𝑒𝑟𝑎𝑏𝑖𝑙𝑖𝑡𝑖𝑒𝑠 𝑖𝑛 𝑉𝑃𝑁, 𝑓𝑖𝑟𝑒𝑤𝑎𝑙𝑙, 𝑒𝑚𝑎𝑖𝑙 𝑠𝑒𝑐𝑢𝑟𝑖𝑡𝑦 𝑔𝑎𝑡𝑒𝑤𝑎𝑦, ℎ𝑦𝑝𝑒𝑟𝑣𝑖𝑠𝑜𝑟𝑠, 𝑎𝑛𝑑 𝑜𝑡ℎ𝑒𝑟 𝑡𝑒𝑐ℎ𝑛𝑜𝑙𝑜𝑔𝑖𝑒𝑠 𝑡ℎ𝑎𝑡 𝑑𝑜 𝑛𝑜𝑡 𝑐𝑜𝑚𝑚𝑜𝑛𝑙𝑦 𝑠𝑢𝑝𝑝𝑜𝑟𝑡 𝑒𝑛𝑑𝑝𝑜𝑖𝑛𝑡 𝑑𝑒𝑡𝑒𝑐𝑡𝑖𝑜𝑛 𝑎𝑛𝑑 𝑟𝑒𝑠𝑝𝑜𝑛𝑠𝑒 𝑠𝑜𝑙𝑢𝑡𝑖𝑜𝑛𝑠." ~ Charles Carmakal, Chief Technology Officer Mandiant (part of Google Cloud)

90

5 Comments

Join us on Wednesday, May 29th at 8:30 AM to discover how CERT Ukraine and CISA work together to combat cyber threats! Limited tickets available - act fast! Link in bio for more details and to get tickets. #CERTUkraine #CISA #CyberDefense #Collaboration #CyberSecurity.

8

Using Tailscale with a VPS from Vultr provides an exit node for only $3.50/mo. Great for an extra layer of security. #Tailscale #Vultr #OPSEC #OSINT https://my.vultr.com/

1

CISA Alerts on Active Exploitation of Critical Vulnerabilities in GeoServer, Linux Kernel, and Roundcube The Cybersecurity and Infrastructure Security Agency (CISA) has sounded the alarm over active exploitation of vulnerabilities in popular software products including GeoServer, the Linux kernel, and Roundcube Webmail, underscoring the urgency for organizations to apply recommended patches. ➡ GeoServer under Threat A severe vulnerability within GeoServer, identified as CVE-2022-24816 and boasting a CVSS score of 9.8, poses a significant risk due to a code injection flaw found in the Jai-Ext open source project. 👁 Attackers could exploit this vulnerability to execute remote code. GeoServer addressed the issue in version 1.2.22, released in April 2022, by removing the capability to inject malicious code. Despite the availability of technical details and proof-of-concept (PoC) exploit code since August 2022, the flaw remains a target for threat actors. ➡Linux Kernel Vulnerability Another critical concern highlighted by CISA is a use-after-free issue within the Linux kernel, tracked as CVE-2022-2586 with a CVSS score of 7.8. This vulnerability has implications for privilege escalation through the manipulation of nft tables in a way that can lead to a use-after-free scenario. Patched in early August 2022 following its demonstration at Pwn2Own Vancouver in May 2022, technical details and PoC code were published shortly after, marking it a significant risk. ➡Roundcube Webmail XSS Issue An older, yet actively exploited vulnerability found in versions of Roundcube Webmail prior to 1.4.5 and 1.3.12, has also been flagged by CISA. Dubbed CVE-2020-13965 and rated with a CVSS score of 6.1, this cross-site scripting (XSS) vulnerability can be triggered through malicious XML attachments. Roundcube issued patches for this flaw in early June 2020, with PoC code following soon after. Although the vulnerability has been known for four years, the recent CISA warning underscores its ongoing threat. ✍ As part of its directive (BOD 22-01), CISA has mandated federal agencies to address these vulnerabilities by implementing the available mitigations or by removing the compromised products from their environments by July 17. CISA emphasizes the high risk these vulnerabilities pose to federal operations, urging immediate action to thwart potential cyberattacks. #cybersecurity #cyberattack #vulnerability #cisa #cyberrisk #cyberthreat https://lnkd.in/dpW-Thne

5

On December 26, 2023, the Department of Defense ("DoD") issued the long-awaited proposed rule for the Cybersecurity Maturity Model Certification ("CMMC") program. There are 3 different levels of compliance and contractors will be required to either conduct a self-assessment or undergo a third-party assessment (the latter referred to as a certification assessment) to demonstrate compliance with their applicable CMMC Level

1

Follow the DVMS Institute for exciting announcements on "HOW" organizations of any Size, Scale, or Complexity can Operationalize a NIST Cybersecurity Framework Digital Value Management System™ capable of delivering the Trusted, Resilient, and Auditable digital outcomes government auditors expect

16

Do you find the false dichotomy between compliance and security to be loathsome, circular, and unhelpful? Are you curious about what security value you're getting for your time, money, and effort when you pursue CMMC certification? Catch the replay of my presentation at CS2 Boston on May 7th at 10am Central (it's free) I'll be answering questions live in chat so come hang out Registration link is in the comments below 👇

65

8 Comments

Dillon Baker breaks down the scariness that is the NVD slowdown during a period in which vulnerability exploitation has become the top initial access vector. It's like being all-time defense without a defensive coordinator - AKA a losing strategy. And, this is across all sectors. The bad guys' moral compass doesn't stop them from holding healthcare, education, food production, or critical infrastructure hostage. #informationsecurity #hacking #threatintelligence

7

CMMC Level 2 Assessment Objective: Security Engineering PRACTICE: Organizations must employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. ASSESSMENT: Examples of systems security engineering concepts and principles include: · Developing layered protections; establishing security policies, architecture, and controls as the foundation for design · Incorporating security requirements into the system development life cycle · Delineating physical and logical security boundaries · Ensuring that developers are trained on how to build secure software · Performing threat modeling to identify use cases, threat agents, attack vectors and patterns, design patterns, and compensating controls needed to mitigate risk Be prepared! Your assessor could ask to 🔍 EXAMINE security planning policy. 🗣 INTERVIEW personnel with responsibility for determining information system security requirements. 📝 TEST organizational processes for system security plan development, review, update, and approval. (CMMC Assessment Guide: Level 2 Version 2.11, page 209) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

48

It will be interesting to see how this impacts #CMMC, especially internationally. Haven't had a chance to read it yet, but I'm looking forward to it! #cyber #cybersecurity #reciprocity #informationsecurity #infosec #DoD #NIST #NIST800171 #CMMC2

24

1 Comment

Coming up this week -- STILL TIME TO REGISTER -- learn about #CMMC #cybersecurity compliance for DoD contractors & subcontractors, 4/18 at 2p: https://lnkd.in/edsTrBup

1

Yesterday, I had the pleasure of attending #CMMCDay. There were a lot of great discussions kicked off by Matthew Travis, The Cyber AB. I took a few key points from the discussion throughout the day. 1. False Claims Act - This will continue to be the primary compliance review for the DoD. Why not 'deputize' those within the DIB to police themselves. With the payouts being received from false claims act, it appears that it will be an effective tool for the DoD. 2. Rulemaking Timeline - The DoD continues to adjudicate public comments on the #CMMC Program rule (CFR 32) and all indications are that it will be released by fall 2024. This rule will make CMMC affective and allow certifications to begin outside the Joint Surveillance Assessment (JSVA) Program. CFR 48 that will mandate CMMC be included in contracts is expected to be delayed until later in 2025. Therefore, the DoD will essentially provide a grace period from Fall 2024 to mid/late 2025 for organizations to get certified prior to mandating it in contracts. 3. Not Just Technology - CMMC is a verification and validation program. Organizations must demonstrate that they are implementing the CMMC Requirements to a third-party assessor; while some controls (e.g., encryption, malicious code scanning) can be performed using technology, other controls (e.g., background screening, training, security assessments) require people to perform. 4. 100% Ready - There was a lot of discussion on the activities within the JSVA. These assessments provide insight into what organizations can expect during a CMMC assessment. One of the key themes coming from these assessments is if you aren't 100% convinced your organization is ready for an assessment - then you’re not ready! If you couldn’t attend and want to learn more about these and other topics, send me a note. I'd be happy to share additional insights. If you were able to attend, what key points did you take away from the event?

14