Jeff S.

This is technically the right approach but converging software factories on to a single DevSecOps platform for programs that are in mature development and fielding is going to be a lot of retrofitting that is not trivial. An open standards and open architecture approach for interoperability is probably the best bet, but standardize on a common platform all new programs moving forward. Great to see CYBERCOM starting to take their acquisition authorities to the next phase. Our adversaries are not constrained by their acquisition bureaucracies.

34

One of my stock security things to talk about has always been the trade-off between usability or convenience and security. Many years ago I saw this quote, attributed to General Benjamin W. Chidlaw, while commander in chief of the joint service Continental Air Defense Command (part of what eventually became NORAD) in 1954: "Simply put, it is possible to have convenience if you want to tolerate insecurity, but if you want security, you must be prepared for inconvenience." It predates IT security, but it always seems to have held in that domain. The more authentication factors you put in, the more annoying you make computing. The more background security processes, the slower you make things. &c, &c, &c. It's more a law of human nature than anything else. I think the latest automation trends have the potential to break this law. The more you can automate security, the more convenient you can make computing. Discuss.

1

SBOM Sharing Primer Read more on the link below. #defense #sbir #military #jointwerx #cmmc #cyber #cybersecurity @jointwerx @blackhaysgroup #GovernmentContracts #InfoSec #CyberDefense #NationalSecurity #DigitalTransformation #PublicSector #Startups #TechInnovation

1

Covered Entity Fact Sheet Read more on the link below. #defense #sbir #military #jointwerx #cmmc #cyber #cybersecurity @jointwerx @blackhaysgroup #GovernmentContracts #InfoSec #CyberDefense #NationalSecurity #DigitalTransformation #PublicSector #Startups #TechInnovation

2

SUMMARY: The NSA's Cybersecurity Collaboration Center offers free, proactive cybersecurity support to businesses and federal partners to combat advanced cyber threats. MAIN POINTS: - The CCC provides free threat intelligence and cybersecurity services to private companies with DOD contracts. - Services include threat analysis, mitigation guidance, and direct incident response assistance from NSA experts. - Small and medium-sized businesses can access high-level cybersecurity resources typically reserved for national security. TAKEAWAYS: - CCC aims to bolster public-private cybersecurity cooperation. - Over 1,000 industry partners have enrolled in CCC services. - CCC processes 70 million DNS queries daily, blocking billions of malicious activities. Bailey Bickley #ccc #nsa #dibservices #dib

146

8 Comments

Attention #CloudSecurity pros, #IAM experts, #DataPrivacy officers, #IT auditors, #CISOs, and #CIOs. This live panel discussion, "Navigating IAM in a Cloud-Based World," on July 25 at 1:00pm ET is for you. Expert practitioners from GuidePoint Security, CrowdStrike, Delinea and Tenable will share insights on integrating Cloud Security and Identity Access Management. Register now and enhance your security posture and operational efficiency. https://okt.to/GVf4Nb

1

Insider Threat – Reporting On Yourself My previous posts summarized SEAD 4 and the Adjudicative Guidelines, which revolve around insider threats and clearance-level adjudication. The next few posts will be about Security Executive Agent Directive 3 (SEAD 3), which covers the activities that covered individuals (people who are cleared or undergoing the clearance process) must report on themselves and on others. Today’s SEAD 3 post will go over reportable activities and situations than an individual must self-report. Some of these activities are more or less stringent dependent on security level, but for this post, they will be listed together. Activities to be reported by all covered individuals are of utmost importance and include foreign travel; foreign contacts; foreign activities (applying/receiving foreign citizenship and passports); attempted elicitation, exploitation, blackmail, coercion, or other efforts to obtain information; media contact where media seeks access to classified or protected information; arrests; bankruptcy; delinquent debt of 120 or greater days; alcohol and drug-related treatment; foreign bank accounts; involvement in foreign business; ownership of foreign property; adoption of non-US citizen children; financial anomalies (infusion of assets of $10,000 or greater); foreign national roommate; cohabitant; marriage; and change of name. Covered individuals who experience these situations should contact the company FSO. Feel free to reach out to me with any questions. #govcon #federalcontracting #ITPSO #insiderthreat #titaniuminfrastructure

7

Good case studies here.

19

The DOD recently released new proposed rules for CMMC 2.0, which aim to protect sensitive #nationalsecurity information. While these new rules include special enclaves to avoid increased overhead costs for small businesses, further clarification is needed to fully support their participation. Small businesses can often lack the required support and resources needed to compete with large companies, as the latter can take on additional overhead without being significantly affected. Ingram Micro Public Sector is one of the leading distributors helping #smallbusinesses remain competitive in the government marketplace. Whether it’s innovative secure and compliant solutions, financial support or contract assistance, our deeply experienced public sector team is committed to supporting small businesses. https://lnkd.in/e3yRXskM

18

Deadly Cyber Attack in Baltimore? Still no word if NTSB is evaluating potential cyber intrusions caused/contributed to the death of six and billion $ destruction of the Key bridge… BTW, this is a non-answer as to if/when NTSB will investigate cyber as a cause of the incident on March 26th: “Maritime cyber experts, the U.S. Coast Guard and the FBI have assessed that the odds of a cyberattack aboard Dali are low, and Homendy said that the investigation has seen no signs to suggest that there was any cyber intrusion…” Same is true if you don’t investigate it… BZ to Rep. Williams - “There's a lot of concern about embedded systems, embedded into what is called a real-time operating system or inside the control logic or the control elements," he said. "That would require an enormous amount of forensics to evaluate . . . is that kind of investigation underway?" Answer….will wait but if not done within first few hours of the incident potential of cyber actors to cover their tracks goes up. https://lnkd.in/e3KwKTgT

40

23 Comments

SAIC's CloudScend™ empowers agencies to accelerate #CloudMigration by securely migrating workloads faster, maximizing value while minimizing risks. This IDC MarketScape report recognizes this solution, check it out to learn more.

1

Navigating Compliance: Understanding CMMC 2.0 and ITAR for Defense Contractors For those in the defense contracting sphere, navigating the maze of regulatory compliance is critical to ensure both operational success and the protection of sensitive data. The Cybersecurity Maturity Model Certification (CMMC) 2.0 and International Traffic in Arms Regulations (ITAR) stand as key pillars in this landscape, each with its own set of rules designed to enhance national security and safeguard crucial information. This blog post delves into the intricacies of CMMC 2.0 and ITAR, shedding light on their unique features and helping defense contractors understand their obligations under each framework. Discover more: https://lnkd.in/gcMXuwQm #cybersecurity #compliance #CMMC #ITAR #blog

24

1 Comment

The Department of Justice recently intervened in a False Claims Act case involving compliance with the requirements of DFARS 252.204-7012 and National Institute of Standards and Technology Special Publication 800-171. In our latest Government Contracts Navigator post, Michael Montalbano and Samarth Barot look at the requirements, this case, and what contractors should do to mitigate any potential liabilities. #govcon #governmentcontracting #cybersecurity #falseclaimsact

9