Steve A. Rodgers

No mention of defense contractors or CMMC in this new DoD playbook on cybersecurity reciprocity. This is written for the government's internal use. However, I'm happy to see evidence that DoD CIO is actively thinking about reciprocity. Reciprocity is different from inheritance. Inheritance is evaluated at a granular level - control by control, requirement by requirement. In general, it is much easier to evaluate inheritance than to evaluate reciprocity. Example of cybersecurity inheritance: Assessor: "Are you performing vulnerability scans to protect your CUI?" Defense contractor: I'm not, but my managed service provider is." Assessor: "Do you have proof that they are actually doing it?" Defense contractor: "They got assessed by an independent audit firm that confirmed they perform vulnerability scans of all their customers. Here is the audit report that shows it." Assessor: "I see that a reputable company did the assessment, they verified the same criteria that I want to see for vulnerability scans, the assessment was performed a few months ago, and that the assessment scope included the department that manages your systems. Looks good. You're "MET" for vulnerability scans." In comparison to inheritance, reciprocity is evaluated as a whole. For the CMMC program, the DoD decides which frameworks are "good enough" for reciprocity. An example of reciprocity: Assessor: "Is your cloud performing all the requirements in CMMC Level 2?" Defense contractor: "No, but it was certified against this other standard, which is pretty stringent too." Assessor: "Hey DoD, do you think that standard is good enough?" DoD: "Yup, we feel it meets or exceeds CMMC Level 2." Assessor: "OK, no further questions about your cloud." No mention of SOC-2 or ISO 27001 in this playbook. This confirms to me that it is very unlikely these will count for anything from a DoD reciprocity standpoint. FedRAMP is the only real candidate I see for CMMC Level 2 reciprocity, though even that isn't official at this point. Shameless plug: Want a double-check on your CMMC preps? Contact Kieri Solutions - Authorized C3PAO to get a Gap Analysis by a Lead Assessor with real world CMMC, 800-171, and Joint Surveillance experience. Nice find, ⚡️Jil Wright! #CMMC

51

6 Comments

It will be interesting to see how this impacts #CMMC, especially internationally. Haven't had a chance to read it yet, but I'm looking forward to it! #cyber #cybersecurity #reciprocity #informationsecurity #infosec #DoD #NIST #NIST800171 #CMMC2

24

1 Comment

Welcome to part TWO of our three-part NIST InfoSeries with Christopher Hills. In this short video, Chris highlights the six core tenets of NIST CSF 2.0, and why each of them is a crucial part of the cybersecurity framework. ✔️ Govern: the newly added function, Govern, allows you to align your cybersecurity efforts with your overall goals and risk management approach – providing a holistic cybersecurity strategy for your organization. ✔️ Identify: Identify enhances your organization's cybersecurity posture by thoroughly assessing your assets, systems, data, and supply chain dependencies. ✔️ Protect: Protect implements robust safeguards for access control, data security, and technology infrastructure hardening, enabling you to gain unparalleled protection for your critical assets. ✔️ Detect: Enable timely discovery of cybersecurity incidents by implementing processes to identify and analyze potential attacks or compromises. ✔️ Respond: When an incident is detected, Respond guides your team with the appropriate actions to contain the impact. This includes incident response planning, mitigation, reporting, and effective communication. ✔️ Recover: After an incident, the Recover function helps restore normal operations and services for your organization. Swiftly bring affected assets and systems back online while communicating during the recovery process. Follow along for part three of the series when we'll be sharing three easy ways you can get started on meeting the NIST CSF 2.0 requirements. Until then, you can learn more in this recent blog post. https://lnkd.in/e4s87VUG #NIST #NIST2 #NISTFramework #Cybersecurity #Compliance #BeyondTrustInfoSeries #Governance

6

This ensures that any Ohio-class sub can destroy up to 192 targets, as each missile can carry up to eight warheads, depending on the yield.

1

Join us on Wednesday, May 29th at 8:30 AM to discover how CERT Ukraine and CISA work together to combat cyber threats! Limited tickets available - act fast! Link in bio for more details and to get tickets. #CERTUkraine #CISA #CyberDefense #Collaboration #CyberSecurity.

8

CMMC - Clean-up in Isle 7, There is a consistent mess in Isle 7. Only if you have had an actual CCA perform a Mock Assessment will an OSC/OSA (Organization Seeking Certification / OSA - Organization Seeking Assessment) know what an assessment requires. (14 policies; 8 plans, 320 Assessment Objectives, 280 Artifacts) You think you are ready for your final Assessment by a C3PAO for CMMC Compliance? You're not! The CMMC Certification Process: 1. You have gone thru your Self-Assessment. (With Expert guidance) 2. Created and entered your score into the SPRS system. 3. You did a "Readiness" Project which kicked out a Gap Analysis and a POA&M. 4. You have a central library (GRC Service? Spreadsheets?) of artifacts as evidence of compliance. All assembled over many months by different contributors. (Guaranteed there is a lack of conformity.) 5. You remediated and documented everything from the POA&M. 6. Your Policies, Procedures and Evidence documents are all ready, and in order? 7. You think you are in a ready state for an Assessor to breeze through all the evidence and certify you. You schedule a C3PAO for your Assessment. 8. The Assessor will review, find issues for remediation ie: gaps. 9. Back to remediation 10. Reschedule the final Assessment 11. Rinse repeat until you are fully compliant. WHAT IF WE COULD SHORTEN THIS PROCESS AND SAVE TIME ($) AND EFFORT? DoD estimates CMMC paperwork burden at 525 hours https://lnkd.in/g48JBDEb Insert step 7.1 - Run a Mock Assessment by a CCA using an AI Based Documentation review Service that produces a POA&M that addresses the integrity of your Artifacts and Evidence in less than a week. Insert step 7.2 Remediate from POA&M items. Insert step 7.3 Re-run the Service for final readiness status. WHY? - To confirm your readiness. - To present a more palatable set of documentation to the C3PAO and accelerate Certification. - To Save countless manhours in the journey to certification. - To help streamline steps 8, 9, 10, and 11 above. NOTE: The Service will generate an immediate ROI. Improve your chances of 1st time certification by working with Gailey Solutions. Get actionable results in days, not weeks. Call Gailey Solutions for CMMC help and guidance. NOTE: We White Label this Service to Partners in the CMMC Community to help you guide your clients thru the Process.

1

JFHQ-DODIN potential elevation sparks curiosity on the impact it may have on the relationship with DISA. With USCYBERCOM's offensive arm CNMF already elevated, the evolving landscape prompts contemplation on future alliances. #JFHQDODIN #USCYBERCOM #CNMF #DISA #cybersecurity

13

Update on the #CMMC timeline!  During the April The Cyber AB Town hall, Matthew Travis pointed out that CFR 48, the procurement side of the rule, was returned to the DoD and not accepted for release for public comment. The rule was originally expected out for public comment in March 2024; however since it was returned to the DoD on Apr 8 the timeline is unclear. Matt speculated that it could be a simple clerical error that could be quickly addressed enabling the rule to be released for public comment in May 2024. Public comments for CFR 32, the CMMC Program rule, are being adjudicated by the DoD. CFR 32 is still expected to be released in fall of 2024. This rule establishes the CMMC Program and authorizes assessments to begin. Therefore, it is likely that assessments can begin prior to being mandated in contracts. This will give the DoD additional fuel for including CMMC in more contracts once CFR 48 is finalized since organization will have plenty of time to get ready. Will your organization be ready for an CMMC assessment in time to beat the rush to ensure you can bid on contracts when CFR 48 is finalized?

31

3 Comments

Training OSC's for CMMC! There a host of companies doing Security Awareness and Threat training. Then there are companies including CUI with the Security Awareness and Threat training. But... What about Role-Based training??? The Top 3 Prime I worked with had hundreds of applications, cloud environments and data centers that included a host of different roles. To appropriately train each role for their particular application, cloud and/or data center was going to cost them about $500,000. The CISO was not going for that and told me: "Figure it out!" Well, I did! I created one CUI Role-Based training program that can be used for any application, cloud and/or data center. I provided the CUI Role-Based training program that could be used for any role for any application, cloud and/or data center for any OSC that I work with. Also... Lifeline Data Centers also provides this CUI Role-Based training program that can be used for any application, cloud and/or data center. I heard that Cyber Tackle Box is incorporating my CUI Role-Based training program that can be used for any application, cloud and/or data center in their training package. This CUI Role-Based training program that can be used for any role for any application, cloud and/or data center is the only training program I have seen that succinctly addresses 3.2.2 "Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities." This includes: "Comprehensive role-based training addresses management, operational, and technical roles and responsibilities covering physical, personnel, and technical controls. Such training can include policies, procedures, tools, and artifacts for the security roles defined. Organizations also provide the training necessary for individuals to carry out their responsibilities related to operations and supply chain security within the context of organizational information security programs." Remember what SP800-171/CMMC v2 is about??? PROTECTING CUI Every control statement should be prefaced with: Protect CUI by.... For 3.2.2: Protect CUI by ensuring that personnel are trained to carry out their assigned information security-related duties and responsibilities. The security-related duties means "CUI Security-related duties." Reach out and set up an appointment on my Calendly to discuss: https://lnkd.in/gJWRphYE #CMMC #DEFENSE #CYBERSECURITY #DEFENSECONTRACTORS

14

“The Cybersecurity and Infrastructure Security Agency is out with new guidance to help federal civilian agencies meet website encryption requirements and move closer toward shoring up the security posture of their internal networks. CISA says the guidance released Thursday would help federal agencies set benchmarks for zero trust, a security methodology where users on a network are never inherently trusted and must be regularly verified to allow for access into sensitive systems and pages. The guidance document centers on Domain Name System, or DNS, a networking hierarchy that catalogs organizations’ sites and maps them to usable web addresses. The protocol, in essence, converts everyday website URLs into a query that internet browsers can use to locate and navigate to a webpage.” #zerotrust #dhs #cisa #cybersecurity #trendingnow https://lnkd.in/e4TzCYSQ

7

'China-aligned' spyware slingers operating since 2018 unmasked at last - Unfading Sea Haze adept at staying under the radar - Bitdefender says it has tracked down and exposed an online gang that has been operating since 2018 nearly without a trace – and likely working for Chinese interests.… - A report from the antivirus maker details the miscreants – dubbed Unfading Sea Haze – and their methods for breaking into Windows PCs and infecting them with data-stealing spyware. - The origin and ultimate goals of Unfading Sea Haze aren't absolutely clear to Bitdefender, but it claims with confidence that the attacks it investigated don't belong to an already known outfit. The country of origin for the crew is likely China according to the report citing Unfading Sea Haze's attacks on nations located in or around the South China Sea, use of tools popular in China, and a specific technique that bears resemblance to another Chinese state-sponsored entity, APT41 https://lnkd.in/ewXKq-iB

1

For those out there who are GRC practitioners, if you don't follow Jacob Horne, you should. In this post he speaks to three things that we all need to know: 1. CMMC is a thing, it will be imposed on the Defense Industrial Base soon... 2. DoD and other government agencies offer services that can help bridge part of the gap between CMMC and where a company in the DIB is in the CMMC Journey. 3. The gap that is left is not trivial. Don't wait... Get to work now... You are already late.

4

CISA has extended the comment period on the new CIRCIA regulations for critical infrastructure. The regulations are, at best, still 18 months away, assuming Congress doesn't kill the whole thing and allow China and Russia to continue to run amok. Read the details at https://lnkd.in/gPGujufV

4

Let the debate begin. My take: A penetration test is an attempt to find as many vulnerabilities, misconfigurations, and logic flaws within the mutually agreed upon scope within a mutually agreed upon period of time. It is not your job to remain “sneaky”. That are other engagement types for that, typically aimed at organizations with a more mature security program. Being noisy is like a free test of their detection capabilities, a free over delivery if you will. Be noisy, just don’t break things. Instead, break into them, with permission. If you’re on a pentest, you already have permission (unless it you assess your actions will break things). Happy Monday! What’s your opinion? (P.S. - it was fun to edit my head on there😂😂😂) #mememonday #penetrationtesting #cybersecurity #Informationsecurity

5

What does FISMA have to do with it? ➡ Many critical infrastructure sectors have interdependencies with drinking water and wastewater services. These include the Chemical, Emergency Services, Energy, Healthcare, and more. “Water, water, everywhere, and not any drop to drink” – “The Rime of the Ancient Mariner,” Samuel Taylor Coleridge 🚧 BL: No water doesn't only mean no coffee! ☕ ➡ In November 2023, the Aliquippa Municipal Water Authority in Pittsburgh experienced a cyberattack after one of its booster stations was hacked by an Iranian-backed cyber group known as ‘Cyber Av3ngers.’ Other major critical infrastructure breaches include the 2022 compromise of the Florida water treatment facility near Tampa days before the Super Bowl. ➡ Critical infrastructure is proving to be an easy target with a high margin of success. While the EPA aspires to follow in the footsteps of the Transportation Security Administration and Food and Drug Administration to provide cybersecurity rules for their sectors, Congress will need to provide the EPA with these new authorities. ➡ Immediate action is needed. The EPA and all federal regulators falling under FISMA must prioritize the security of their networks. This is crucial to ensure they can continue their operations, reducing the threat of malicious cyber actors breaching their networks. By doing so, they protect their own digital enterprise and set an example for their sectors. 💡 At Forescout Technologies Inc., We don't just SEE all IT, IoT IMoT, and OT assets on your network; we PROTECT every connected asset - managed and unmanaged. Read the full article here: https://lnkd.in/ezqUfFcC

57

11 Comments

FBI Director Wray issued a dire warning: The Chinese government is waging a tenacious cyber assault on America's critical infrastructure. Their goal? Sabotage systems keeping our nation running to "induce panic and break our will." The opening salvo is already striking. From the VoltTyphoon campaign infecting routers across U.S. networks, to piggybacking Microsoft Exchange vulnerabilities, to supply chain compromises - the Chinese cyber army is pressing its multi-vector campaign.

28

10 Comments