Aaron Gould

DISA Expands Thunderdome Zero Trust Program Deployment; Brian Hermann, Quoted. ExecutiveGov discusses the Defense Information Systems Agency's (DISA) expansion of the Thunderdome zero trust program. In 2023, the program was deployed to 15 sites and plans are underway to extend it to 60 more sites in 2024. The program involves four key components: 🔐 Customer security stacks 🔗 Software-defined wide area networking 📴 Secure access service edge capability, and 💯 Application security stacks. Brian Hermann, DISA's director of the cybersecurity and analytics directorate, emphasized the program's role in advancing zero trust architecture, which is crucial for organizational security. DISA has also finalized the contracting process to support the U.S. Coast Guard’s network security improvement efforts through Thunderdome. Versa Networks is at the forefront of enhancing cybersecurity with their pivotal role in DISA's Thunderdome project. Their cutting-edge solutions are setting new standards in securing our nation's digital infrastructure. For more details, you can read the full article here:-https://lnkd.in/dhj2iTT9 #DISA #Thunderdome #ZeroTrust #Cybersecurity #versanetworks #channelpartners

3

The election is less than 5 months away. Here's 3 reasons I think the CMMC Program final rule will beat it. 𝟭) 𝗧𝗵𝗲 𝗽𝗿𝗼𝗽𝗼𝘀𝗲𝗱 𝗿𝘂𝗹𝗲 𝘄𝗲𝗻𝘁 𝘁𝗼 𝘁𝗵𝗲 𝗦𝗺𝗮𝗹𝗹 𝗕𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗔𝗱𝗺𝗶𝗻𝗶𝘀𝘁𝗿𝗮𝘁𝗶𝗼𝗻 𝗳𝗶𝗿𝘀𝘁. Since 2021 the DoD has made it a habit to not say much about CMMC. However, back in the Summer of 2023 the DoD was very clear that they sent the CMMC Program proposed rule to the SBA before submitting the rule for regulatory review. That clearly seems like a preemptive step to addressing public comments... 𝟮) 𝗧𝗵𝗲 𝗽𝗿𝗼𝗽𝗼𝘀𝗲𝗱 𝗿𝘂𝗹𝗲 𝗶𝗻𝗰𝗹𝘂𝗱𝗲𝗱 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗲𝘀 𝘁𝗼 𝗽𝘂𝗯𝗹𝗶𝗰 𝗰𝗼𝗺𝗺𝗲𝗻𝘁𝘀. Speaking of public comments, a significant portion of the proposed rule contained responses to public comments received on the 2020 CMMC rule. Typically, public comments receive responses in final rules, not proposed rules. This feels like another preemptive step that has allowed the DoD to take public comments received earlier this year and respond/dismiss them with alacrity. 𝟯) 𝗠𝗼𝗿𝗲 𝗿𝘂𝗹𝗲𝘀 𝗮𝗿𝗲 𝗽𝘂𝗯𝗹𝗶𝘀𝗵𝗲𝗱 𝗶𝗻 𝘁𝗿𝗮𝗻𝘀𝗶𝘁𝗶𝗼𝗻 𝘆𝗲𝗮𝗿𝘀 𝘁𝗵𝗮𝗻 𝗮𝗻𝘆 𝗼𝘁𝗵𝗲𝗿 𝘁𝗶𝗺𝗲. GAO has analyzed "midnight rulemaking" - the term used for rulemaking in the final year of an administration. It isn't just individual agencies that are eager to complete their work, but also the administration itself and, therefore, the Office of Management and Budget (OMB) - the ones responsible for final review of the final rule later this year. 𝟰) 𝗛𝗲𝗿𝗲'𝘀 𝗮 𝗯𝗼𝗻𝘂𝘀: 𝗔𝗰𝗰𝗼𝗿𝗱𝗶𝗻𝗴 𝘁𝗼 𝘁𝗵𝗲 𝗿𝘂𝗺𝗼𝗿 𝗺𝗶𝗹𝗹, 𝘁𝗵𝗲 𝗗𝗼𝗗 𝗵𝗮𝘀 𝗮𝗹𝗿𝗲𝗮𝗱𝘆 𝗳𝗶𝗻𝗶𝘀𝗵𝗲𝗱 𝗿𝗲𝘀𝗽𝗼𝗻𝗱𝗶𝗻𝗴 𝘁𝗼 𝗽𝘂𝗯𝗹𝗶𝗰 𝗰𝗼𝗺𝗺𝗲𝗻𝘁𝘀 𝗮𝗻𝗱 𝘀𝗲𝗻𝘁 𝘁𝗵𝗲 𝗳𝗶𝗻𝗮𝗹 𝗿𝘂𝗹𝗲 𝗶𝗻𝘁𝗼 𝘁𝗵𝗲 𝗹𝗮𝘀𝘁 𝘀𝘁𝗮𝗴𝗲𝘀 𝗼𝗳 𝗿𝗲𝗱 𝘁𝗮𝗽𝗲. There were over 1,800 public comments on the CMMC program proposed rule - 140% more comments than the 2020 CMMC rule. DoD adjudicated comments on a rolling basis as they were submitted which drastically accelerated the process compared to waiting until the end of the comment period. Ripping through such a huge number of comments so quickly suggests that very little of the proposed rule has changed. That's a huge advantage for those companies who have implemented SP 800-171 and are ready for CMMC assessment. For everyone else it's as big as the flashing red warning light has ever been.

76

14 Comments

The CIRCIA proposed rule will impact defense contractors and subs with additional cyber incident reporting requirements beyond DFARS 7012. Did anybody else notice that the DIB makes up by far the most number of entities affected and represents the largest amount of costs incurred? 𝟮𝟯% 𝗼𝗳 𝗮𝗹𝗹 𝗮𝗳𝗳𝗲𝗰𝘁𝗲𝗱 𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀 𝟭𝟲% 𝗼𝗳 𝘁𝗼𝘁𝗮𝗹 𝗽𝗿𝗼𝗴𝗿𝗮𝗺 𝗰𝗼𝘀𝘁𝘀 On top of that, 𝟵𝟴% 𝗼𝗳 𝗮𝗹𝗹 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀 𝗮𝗿𝗲 𝘀𝗺𝗮𝗹𝗹 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀𝗲𝘀 At what point is the CIRCIA rule really just a Department of Defense small business cyber rule? According to the rule CISA is gonna try super duper hard to cooperate with the DoD in order to establish a "CIRCIA Agreement" to reduce duplicative reporting requirements. I don't know if you're holding your breath but I'm not. Luckily the rule has this tidbit: 𝗔𝘀𝘀𝗶𝘀𝘁𝗮𝗻𝗰𝗲 𝗳𝗼𝗿 𝗦𝗺𝗮𝗹𝗹 𝗘𝗻𝘁𝗶𝘁𝗶𝗲𝘀 "CISA wants to assist small entities in understanding this proposed rule so that they can better evaluate its effects on them and participate in the rulemaking. If this proposed rule would affect your small business, organization, or governmental jurisdiction and you have questions concerning its provisions or options for compliance," please contact: Todd Klessman, CIRCIA Rulemaking Team Lead, CISA circia@cisa[.]dhs[.]gov 202-964-6869 What's the over/under on the number of voicemails left by DoD so far?

45

32 Comments

🚀 Enhancing Cybersecurity with LogicFinder’s Solutions! 🚀 We're excited to spotlight our ASSIST Tool Development project for the DoD. This tool enhances data analysis, processing, and utilization, empowering DoD personnel with critical insights for informed decisions and operational superiority. 🔗 Learn more: www.logicfinder.net 📧 Contact us: info@logicfinder.net #CyberSecurity #Innovation #Technology #DoD #Defense #DataAnalysis #IntelligenceSolutions #TechInnovation #OperationalExcellence #SupportTools #AI #MachineLearning #BigData #DataScience #InformationSecurity #CyberDefense #TechSolutions #ITConsulting #SecureTech #AdvancedTechnologies #MilitarySupport #DataProcessing #CuttingEdgeTech #TechDevelopment #LogicFinder #TechIndustry #DigitalTransformation #DataInsights #DoDSolutions #MissionCritical #NationalSecurity

6

'China-aligned' spyware slingers operating since 2018 unmasked at last - Unfading Sea Haze adept at staying under the radar - Bitdefender says it has tracked down and exposed an online gang that has been operating since 2018 nearly without a trace – and likely working for Chinese interests.… - A report from the antivirus maker details the miscreants – dubbed Unfading Sea Haze – and their methods for breaking into Windows PCs and infecting them with data-stealing spyware. - The origin and ultimate goals of Unfading Sea Haze aren't absolutely clear to Bitdefender, but it claims with confidence that the attacks it investigated don't belong to an already known outfit. The country of origin for the crew is likely China according to the report citing Unfading Sea Haze's attacks on nations located in or around the South China Sea, use of tools popular in China, and a specific technique that bears resemblance to another Chinese state-sponsored entity, APT41 https://lnkd.in/ewXKq-iB

1

There are few things more precious than the gift of time. Our Significance Government Staff Technology Empowerment Program (G-STEP) team gave a lot of time back to those DoD Financial Managers who dropped into room 127A Society of Defense Financial Management (SDFM)’s National PDI in Phoenix. If you are in Phoenix, we will be manning the room from 8AM - 4PM tomorrow and Friday. Stop in and we’ll show you how MS365 applications (Power Automate, Power BI, Power Query, etc …) and the tools available to you in Advana can give you time back as well!! #GSTEP, #dataanalytics, #innovation

33

1 Comment

Bill Greenwalt at the American Enterprise Institute and a former deputy undersecretary of defense for industrial policy makes a compelling argument for DoD and Congress to step in and scrap CMMC 2.0. CMMC compliance will cost $4 billion (!) annually and will unfairly impact small businesses that DoD wants in (or back in) the defense industrial base. Large contractors will mostly pass on their costs through cost plus contracts, but small businesses will have to invest an early (low) estimate of $100,000 or risk being barred from Government contracts. "Companies that fail these audits are punished ... This punitive enforcement through the contracting process will surely dissuade new and innovative companies from doing business with DoD." "Finally, there's the open question of whether the type of information CMMC seeks to protect, controlled unclassified information (CUI), needs stringent safeguards at all... most CUI probably does not need to be controlled and is only designated as such because of an aversion to risk among those marking it." "CMMC 2.0 is not the way to achieve these objectives and it would be best for DoD to cancel the project. If it doesn't, Congress should act before too many resources are wasted on this effort." #defenseindustry #CMMC #cybersecurity https://lnkd.in/ercSR_KH

11

8 Comments

CMMC Conversations - Understand DoD requirements for access to CUI. Learn more here from our training and education partner, DTC Global: https://lnkd.in/ggu3FVcy PS.L2-3.9.1 CR.6.2. NIST SP 800-171 discussion provides guidance for, “Personnel security screening (vetting) activities involve the evaluation/assessment of individual’s conduct, integrity, judgment, loyalty, reliability, and stability (i.e., the trustworthiness of the individual) prior to authorizing access to organizational systems containing CUI”. The screening activities reflect applicable federal laws, Executive Orders, directives, policies, regulations, and specific criteria established for the level of access required for assigned positions. PS.L2-3.9.1[a] Personnel are QUALIFIED for ACCESS when: oIndividual is permitted and not prohibited to access the CUI categories or restricted by markings on document. ACCESS is within the scope of assigned duties. - Individual is screened. PS.L2-3.9.1 - Individual is trained according to CUI Notice 2020-1 and the DoD’s minimum required training. - Completes training for their role-based duties and responsibilities. - Completed training for required for access to any CUI category in the CUI Registry. - Completes NIST required cybersecurity awareness and insider threat training. DoDI 8582.01. (3.1) Unclassified nonpublic DoD information may be disseminated by the contractor, grantee, or awardee to further the contract, grant, or agreement objectives, provided the information is disseminated within the scope of assigned duties, is not otherwise restricted by the contract, grant or agreement, and with a clear expectation that confidentiality will be preserved. hashtag #CUI #CMMC #DoD #CISC #DFARS #NIST #cybercommunity #CUISupply #DTCGlobal

1

I am intrigued by the brains who work to protect us from #cyberthreats. If you already have your CIS degree and are working in the field, where do you find your continuing education to stay ahead of the ever-evolving landscape of cyber threats? Are you using online courses, certifications, conferences, or other resources?I'm curious to hear where you turn to keep your skills sharp and stay on top of the latest trends in cybersecurity. Drop your favorite resources in the comments below, please! 💻🔍 #CyberSecurity #ContinuingEducation #CyberThreats #KnowledgeSharing

4

5 Comments

The DoD Chief Information Officer released the DoD Cybersecurity Reciprocity Playbook today. It's a highly readable document but probably takes more time to read than LinkedIn's estimate of 39 minutes... Even though the DoD has been working on reciprocity for years (DoD CIO issued a memo in Oct 2016 emphasizing that reciprocity is the default for assessment and authorization of a system already deployed), its great that the concept is being reemphasized. One key point: It's all about context. This is underscored in Section 3: "Reciprocity is not a passive acceptance of security assessments, certifications, or authorizations from other entities without careful consideration, and comprehensive review of the context, risk factors, sensitivity of the data, and relevance to the specific systems or networks within its purview. Instead, reciprocity involves a thoughtful, risk-based assessment process and a careful examination of the BoE (body of evidence) to determine their applicability and suitability within a specific security landscape. In essence, reciprocity emphasizes the importance of maintaining a strong security posture while maximizing efficiency through the re-use of the BoE. Thus reciprocity demands a discerning approach that safeguards the integrity of its systems, while leveraging the insights and efforts of trusted partners to enhance its cybersecurity resilience." The document goes on to say "Reciprocity is designed to expedite authorization through the re-use of assessments and artifacts, which leads to cost reduction. Executed appropriately, reciprocity reduces redundant testing, assessment, and documentation, and the associated costs in time and resources." Reciprocity is not a panacea or a one-size-fits-all solution; reciprocity is simply another tool in the toolbox for cybersecurity professionals to employ. #cybersecurity #rmf #innovativeAF

12

1 Comment

Key considerations on ZT overlays; - rethink the perimeter - multiple attributes , multiple verifications #zerotrust #security

26

5 Comments

🌟 Join the MTR Community! Please Share | Jobs for US Veterans🌟 At Military Technical Recruiting, LLC (MTR), we specialize in connecting Transitioning Service Members, Reservists, Veterans, and their spouses with rewarding career opportunities. We understand that transitioning from military service to a civilian career can be challenging, and we are here to make that journey smoother and more successful. Why MTR? 🔹 Dedicated Focus: Our firm is dedicated exclusively to serving the military community and their families. 🔹 Constant Opportunities: We are continuously updating our job listings with new roles across various industries. 🔹 Personalized Support: By creating a profile with us, you ensure we can match you with the right opportunities as soon as they arise. What You Can Do: 1. Create Your Profile: Visit our MTR Careers Portal and complete your profile to the best of your ability. (The link is down below) 2. Stay Connected: Once your profile is complete, send me a direct message with the email you have created your profile with so I can keep an eye out for roles that fit your skills and aspirations. MTR Careers Portal: https://lnkd.in/gM8iWnN2. 🌟Important Note: If we don’t have a role you're interested in right now, don't worry! We are constantly getting new roles. By making a profile, you help us better understand your needs and the community. When opportunities arise, we will be sure to reach out to you. We are committed to helping you transition to civilian life with exciting new opportunities. Whether you are a Transitioning Service Member, Reservist, Veteran, or a family member looking for new opportunities, let’s connect and explore how MTR can support your next career move. #MilitaryTransition #VeteranCareers #JobOpportunities #MTR #JoinOurCommunity

6

🚨 Attention DoD Contractors! 🚨 Did you know? All DoD prime- and sub-contractors planning to bid on future contracts will be required to obtain a CMMC certification prior to contract award. 🛡️ Don't let this requirement intimidate you! Two-14 experts are here to ensure your company is compliant and bid-ready. Whether you're just starting or need to update your current cybersecurity measures, we've got you covered. 📞 Contact us today to find out how we can help you navigate the complexities of the CMMC certification. Let's get you prepared to secure those contracts with confidence! 🔗 www.two14aviation.com #CMMC #Cybersecurity #DoDContractors #DefenseIndustry #Compliance #Two14Experts #SecureYourSuccess

2

DISA Expands Thunderdome Zero Trust Program Deployment; Brian Hermann, Quoted. ExecutiveGov discusses the Defense Information Systems Agency's (DISA) expansion of the Thunderdome zero trust program. In 2023, the program was deployed to 15 sites and plans are underway to extend it to 60 more sites in 2024. The program involves four key components: 🔐 Customer security stacks 🔗 Software-defined wide area networking 📴 Secure access service edge capability, and 💯 Application security stacks. Brian Hermann, DISA's director of the cybersecurity and analytics directorate, emphasized the program's role in advancing zero trust architecture, which is crucial for organizational security. DISA has also finalized the contracting process to support the U.S. Coast Guard’s network security improvement efforts through Thunderdome. Versa Networks is at the forefront of enhancing cybersecurity with their pivotal role in DISA's Thunderdome project. Their cutting-edge solutions are setting new standards in securing our nation's digital infrastructure. For more details, you can read the full article here:-https://lnkd.in/dYX76H8s #DISA #Thunderdome #ZeroTrust #Cybersecurity #versanetworks #channelpartners

2

See you at Department of the Navy Chief Information Officer (DON CIO) #ITEast2024 in Norfolk this week. Connect with CORAS Team members Mark Fedeli and Robert Nichels, PMP and learn how we are supporting #USN Vice Admirals to PMs to secure information at all levels. #CDIO #5G #CISO #Cybersecurity #DataAvailability #DataInteroperability #InfoSharing #Strategy #AI #DriverTrees #DecisionManagement #FedRAMPHigh #IL5 #SIPR

13

1 Comment

📢 Attention Defense Contracting Community: 📢 Attention John M. Tenaglia, Principal Director, Defense Pricing and Contracting In light of the recently released MEMORANDUM FOR COMMAND, titled "Class Deviation—Safeguarding Covered Defense Information and Cyber Incident Reporting," it's crucial to reconsider certain aspects of the CMMC 2.0 program. Referencing the initial implementation of DFARS clause 252.204-7012: "(ii)(A) The Contractor shall implement NIST SP 800-171, as soon as practical, but not later than December 31, 2017." In this context, the clauses clearly state that THIRD-PARTY Assessments or Certifications of Compliance are NOT recognized by the DoD, nor does the DoD certify that a contractor is compliant with the NIST SP 800-171 security requirements. Implementing these clauses would render the proposed CMMC 2.0 program obsolete and could potentially save $4 billion. Additionally, using NIST SP 800-171 Rev 3 as the standard would allow the Defense Industrial Base (DIB) to submit Organization Defined Parameters (ODP) to meet evolving cybersecurity requirements, ensuring continual security and compliance. Let's align policy with practical, cost-effective cybersecurity measures for our defense contractors.....IMHO K #Cybersecurity #CMMC #DefenseContracting #NISTSP800171#$4B

4

Over the past few years the team at Summit 7 has had more than 3,600 conversations with individual defense contractors of all sizes. And the number one question, by far? 𝗪𝗵𝗮𝘁 𝗱𝗼𝗲𝘀 𝗺𝘆 𝗯𝘂𝗱𝗴𝗲𝘁 𝗻𝗲𝗲𝗱 𝘁𝗼 𝗯𝗲? But, while the DoD provides very loose estimates for the cost of CMMC assessments, they have never estimated the cost of implementing the security requirements assessed by CMMC. 𝗧𝗵𝗲 𝗼𝗻𝗹𝘆 𝗰𝗹𝘂𝗲: DoD thinks companies should be spending 𝗮𝘁 𝗹𝗲𝗮𝘀𝘁 𝟬.𝟱% of revenue on security. However, the government has estimated the cost to implement and maintain NIST SP 800-53, the big brother to NIST SP 800-171. Since we know a little something about both, we did some math. We framed the numbers against our own operations and the solutions we've engineered for nearly 1,000 defense contractors and made it into a webinar that you can watch on-demand. Register at the links below 👇

62

6 Comments

Responses to the RFI are due 10-June. As the Army unveils plans for its monumental $1B software development contract, it's evident that the landscape of defense IT is evolving at an unprecedented pace. The New Modern Software Development IDIQ demands not just capability but agility, security, and innovation. To stay ahead in this dynamic environment, industry players must prioritize modern software development practices like DevSecOps, Agile methodologies, and continuous integration/continuous delivery. Customization is key, whether it's in developing new products or modifying existing solutions. Moreover, the ability to provide SaaS hosting and robust security measures is non-negotiable. But beyond these basics, differentiation lies in embracing cutting-edge technologies. Industry must demonstrate proficiency in emerging areas like AI, ML, and cybersecurity. Mastery of these technologies will not only enhance product offerings but also ensure readiness for future challenges. As the Army seeks to modernize its software capabilities, it's imperative for industry partners to align with its vision. This is where CRG's expertise comes into play. With our comprehensive support in pre- and post-award processes, we enable companies to navigate complex procurement landscapes and seize lucrative opportunities. Don't miss your chance to be at the forefront of defense IT innovation - contact CRG today. CRG’s SMEs & dedicated teams excel in providing comprehensive pre- and post-award support. Visit https://crgroupinc.com/ or reach out to us at contact@crgroupinc.com to learn more about how CRG can empower your organization. IL - VA - DC - Dubai, UAE. #DefenseIT #SoftwareDevelopment #ArmyContract #Modernization #Agile #DevSecOps #Cybersecurity #AI #MachineLearning #DoDContracts #USMilitary #TechInnovation #SoftwareEngineering #ITModernization #CyberDefense #AgileDevelopment #DevOps #SoftwareSolutions #DefenseTechnology #LockheedMartin #NorthropGrumman #RaytheonTechnologies #Boeing #GeneralDynamic #L3HarrisTechnologies #Leidos #BAESystems #SAIC #CACIInternational #BoozAllenHamilton #GeneralElectric #IBM #Microsoft #Oracle #CiscoSystems #Accenture #HewlettPackardEnterprise #DellTechnologies #AmazonWebServices #EDGE 

2