Bill Hooper

Fantastic insights from Imran Umar and Erica Banks on how the federal civilian executive branch can implement zero trust using several blueprints for success from DOD’s Thunderdome project. More in the new FNN eBook linked below.

12

DoD CIO announces the public release of the DoD Cybersecurity Reciprocity Playbook. This playbook, referenced in the DSD's Reciprocity Memo, provides guidance for employing cybersecurity reciprocity in DoD systems. It defines reciprocity as it relates to cybersecurity, discusses the benefits and risks, and includes example possible use cases. For more information read the playbook here: https://lnkd.in/e4K3d8DQ

1,047

61 Comments

SKILLS-BASED HIRING is increasingly being adopted. Since 2109, iQ4 has invested significantly to be a market leader in Learning and Employment Record system - including a Digital Wallet that translates resumés, academic and military transcripts, and certifications into skills (professional, IT, operational/leadership) so Wallet holders can explore career pathways and get matched to vacancies. Read more in the attached article.

15

Read our recommendations for federal agencies to maximize transformation through the adoption of Agile for application development processes, modernized DevSecOps and low-code methodologies: https://lnkd.in/eynfi9Fb

6

The GAO report highlights the barriers faced by federal agencies when implementing cybersecurity risk management processes. Addressing these hurdles ensures a strong and resilient cybersecurity posture. One of the key areas for improvement is the need to refine cyber risk evaluation methods. Currently, federal agencies heavily rely on the Common Vulnerability Scoring System (CVSS) to assess the criticality of security vulnerabilities in software applications. However, this system has its limitations. A more nuanced approach that considers multiple factors would enable a more sophisticated and effective response to cybersecurity threats.

5

It took me a couple of years working with the DoD before I realized that there are two competing definitions of DevSecOps in wide use. In this post, I explain the two, how I think we got here, the problems we’re facing, and how can easily address fix the bug.

16

2 Comments

The DoD Zero Trust Roadmap contains 152 functions and activities, divided across 7 pillars, intended to drive DoD agencies and defense industrial base contractors to a new era of zero trust security. This is a challenging task, but one that must happen for our national security. Xage Security has published a quick intro to the roadmap, and a robust mapping of how Xage supports 90% of the requirements. Watch the embedded video for a 3 minute summary, or request the PDF for a deep dive into how to achieve the Zero Trust Roadmap objectives.

2

The DoD Procurement Toolbox FAQ for Cyber is a must read for Defense Industrial Base cyber professionals. Tremendous amount of good clarifying information in there. This is also explicitly linked out of the DFARS as a place to receive more clarifying information. The last update was a few years ago. Although at first glance I do not see any huge or surprising changes, the overall document is a significant resource that should be on everyone's hot list who is implementing or assessing NIST 800-171 and CMMC.

23

1 Comment

This could be huge! Everyone on the software/AI side of DefenseTech should respond to this RFI for the Army's planned Fast Track MATOC for PEO IEW&S. Don't know what these acronyms mean or how they work? Message me! #AI #Governmentcontracts #defensetech

11

Defense Information Systems Agency's Director of Cybersecurity and Analytics, Brian Hermann, announced that their Thunderdome zero trust architecture will be extended to 60 more sites as part of the DOD's effort to reach their 2027 zero-trust goals. Hermann said these new cybersecurity meassures will also improve data management automation: "We need to have the tools to build the rules so that we can automate those things and be confident that we’re getting what we need out of that". It's amazing to see the strides DISA is making towards their objectives and I agree, this will help with far more than just cybersecurity! Read more: https://lnkd.in/d8xKkR-b #cybersecurity #govcon #disa #automation #dod #nationalsecurity

210

13 Comments

Check out ATARC's newest White Paper: Harnessing Next-Generation AI Solutions for Enhanced Federal Security Operations! 📄 Federal authorities convened to examine the complexities and potentials of employing generative AI to bolster Federal #security. Read along as panelists dive into the diverse ramifications of AI in #cybersecurity, spanning economic dynamics, policy adaptations, technological susceptibilities, and the prospect of formulating international #AI norms. Read here - https://ow.ly/3voy50RwmMK

1

Really great summary of best practices for container hardening.

5

Huge update from the DoD Chief Information Officer, releasing the DoD Cybersecurity Reciprocity Playbook. Highlights of what the playbook covers: 📌 DoD defines reciprocity as the agreement among participating organizations to accept each other’s security assessments, to reuse system resources, and/or to accept each other’s assessed security posture to share information. Effectively, if one office certifies that a system is cyber secure, then all offices can accept it instead of having to redo the certification process. 📌 Reciprocity is NOT a passive acceptance of security assessments, certifications, or authorizations from other entities without careful consideration, and comprehensive review of the context, risk factors, sensitivity of the data, and relevance to the specific systems or networks within its purview. 📌 Instead, reciprocity involves a thoughtful, risk-based assessment process and a careful examination of the body of evidence to determine their applicability and suitability within a specific security landscape. 📌 Reciprocity is designed to expedite authorization through the re-use of assessments and artifacts, which leads to cost reduction. Executed appropriately, reciprocity reduces redundant testing, assessment and documentation, and the associated costs in time and resources. 📌 To support reciprocity, DoD Components share security authorization packages with affected information owners and interconnected system owners. The re-use of artifacts allows AOs to accept assessments done on systems they intend to deploy rather than repeat the assessments. Acceptance of relevant artifacts from similar assessments results in fewer costly assessments, allowing systems to be authorized more quickly and efficiently. Read more in the document attached and links below. #DoD #DHS #defenseinnovation #defense #defensetechnology #technology #tech #nationalsecurity #jadc2 #army #navy #airforce #cyber #ATO

15

The United States Department of Defense (DOD) is launching a fully operational Vulnerability Disclosure Program (VDP) for the defense industrial base (DIB). This program allows independent white-hat hackers to identify and analyze vulnerabilities in companies' systems. Participation is voluntary and free for companies. The initiative aims to enhance cybersecurity in the DIB and promote timely mitigation of vulnerabilities. The DOD's collaboration with cybersecurity company HackerOne during a yearlong pilot has paved the way for this official program. #DoD #Cybersecurity #VulnerabilityDisclosure #DefenseIndustrialBase #CyberResilience

2

AI has become a catalyst for digital transformation across all government agencies, including innovative projects at DHS and DoD. At this year’s Adobe Government Forum, Defense Department CDAO and CTO, Bill Streilein highlighted the role genAI plays in strengthening the DoD’s intelligence analysis and streamlining back-office functions to increase productivity across the board. Beyond that, U.S. Department of Homeland Security CAIO and CIO, Eric Hysen detailed how AI is helping secure our borders — assisting agents in more than 200 interceptions of illegal narcotics. It’s inspiring to see how agencies are evolving in how they use AI to achieve mission outcomes and operational efficiency. ➡ Read more here: https://lnkd.in/eR93g52U #AdobeGovForum #DOD #DHS

38

The CIRCIA proposed rule will impact defense contractors and subs with additional cyber incident reporting requirements beyond DFARS 7012. Did anybody else notice that the DIB makes up by far the most number of entities affected and represents the largest amount of costs incurred? 𝟮𝟯% 𝗼𝗳 𝗮𝗹𝗹 𝗮𝗳𝗳𝗲𝗰𝘁𝗲𝗱 𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀 𝟭𝟲% 𝗼𝗳 𝘁𝗼𝘁𝗮𝗹 𝗽𝗿𝗼𝗴𝗿𝗮𝗺 𝗰𝗼𝘀𝘁𝘀 On top of that, 𝟵𝟴% 𝗼𝗳 𝗮𝗹𝗹 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀 𝗮𝗿𝗲 𝘀𝗺𝗮𝗹𝗹 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀𝗲𝘀 At what point is the CIRCIA rule really just a Department of Defense small business cyber rule? According to the rule CISA is gonna try super duper hard to cooperate with the DoD in order to establish a "CIRCIA Agreement" to reduce duplicative reporting requirements. I don't know if you're holding your breath but I'm not. Luckily the rule has this tidbit: 𝗔𝘀𝘀𝗶𝘀𝘁𝗮𝗻𝗰𝗲 𝗳𝗼𝗿 𝗦𝗺𝗮𝗹𝗹 𝗘𝗻𝘁𝗶𝘁𝗶𝗲𝘀 "CISA wants to assist small entities in understanding this proposed rule so that they can better evaluate its effects on them and participate in the rulemaking. If this proposed rule would affect your small business, organization, or governmental jurisdiction and you have questions concerning its provisions or options for compliance," please contact: Todd Klessman, CIRCIA Rulemaking Team Lead, CISA circia@cisa[.]dhs[.]gov 202-964-6869 What's the over/under on the number of voicemails left by DoD so far?

45

32 Comments

Ligeia Zeruto - Thank you for all you do to help us deliver Zero Trust and accelerate our FedRAMP journey! #securitythreats #zeroday #databreach #securityrisk #cyberwarfare #cisolife #cisoproblems #cisosolutions #securityleadership #runtimehardening #cloudnativesecurity #CISO

17

As everything rapidly moves to the cloud this is scary. One of the main reasons to move to the cloud protection and survivability of your data is completely negated.

13

5 Comments