Travis Howell

New update from the DoD on the CMMC program. “We are moving forward, we’re hoping by the first quarter of calendar year [2025] we’ll be able to start enforcing this and putting this in contracts as we go forward. We just keep plugging along because this has been discovered learning, and they’ve got so many roadblocks that have popped up and so much resistance to this, but we feel this is super important,” - David McKeown, DCIO(CS) & SISO Read the article for more details. #cmmc #dod #cybersecurity

24

8 Comments

The United States Marine Corps has rolled out a new maintenance tracking system called QSRMax, which uses QR codes in barracks for Marines to easily report and track maintenance issues. The QSRMax system allows Marines to simply scan a QR code with their phones to report a problem, which is then received by barracks managers. This new digital system aims to improve accountability and responsiveness for maintenance requests, giving Marines the ability to track their requests in real-time. The system is part of the Marine Corps' "Barracks 2030" plan, which is aimed at improving housing conditions for Marines. It builds on a successful pilot program at Marine Corps Air Station Miramar in California, where the QSRMax concept was tested. This new maintenance tracking system is expected to help address longstanding issues with barracks upkeep and responsiveness to Marines' requests. By empowering Marines to report problems quickly and giving leadership better visibility, the Marine Corps hopes to improve living conditions and increase transparency. #MarineCorps #Barracks2030 #Maintenance #QRCodes #Facilities #MilitaryLife

1

Unveiling Olympus: A game changer in cloud service management by the Defense Information Systems Agency. This platform harnesses technology to facilitate defense agencies in evolving their cloud environments at ease, minus the hassle of enterprise network connectivity. With integration to DISA’s Vulcan DevSecOps, Olympus brings to fore capabilities unseen before! Click here to learn more 👉 https://bit.ly/3wFYGvz #cloudmanagement #defenseagencies #DISA #Olympus

65

Exciting! Specifically that DoD is emphasizing ATO reciprocity between components and departments. Although the “escape clause” is a little broad: During his keynote at the annual GEOINT Symposium on Wednesday, Pentagon Chief Information Officer John Sherman unveiled a new one-page memorandum signed by Deputy Defense Secretary Kathleen Hicks on May 2 that directs “testing re-use and reciprocity to be implemented [by DOD authorizing officials] except when the cybersecurity risk is too great.” Attempts to standardize ATO evaluation assessments have been challenged in some key ways as far as I’ve seen. Will be interesting to see if this moves the needle… https://lnkd.in/eyScAvfE

5

It is too big a burden for small businesses especially construction and mechanical subcontractors that work on military bases. There are requirements to bring more non traditional contractors into the DoD as a % of work content. How to primes meet this requirement when they have to force these small companies into compliance with CMMC?

2

2 Comments

On June 27, 2024 the Department of Defense (DoD) has submitted the Cybersecurity Maturity Model Certification (CMMC) Program rule to the Office of Information and Regulatory Affairs (OIRA) for final review and publication. Here are some important timelines to consider: *OIRA has 90-120 days to review the rule, putting the rule publication date between late September through late October. *Once published in the Federal Register, the rule will be effective 60 days later, making the CMMC Program official You can see the CMMC Program rule status under ‘Department of Defense’: https://lnkd.in/eMv4tAh7 #cmmc #dod #cybersecurity

29

1 Comment

Stepping into the future with #DISANext - a comprehensive 5-year blueprint from the Defense Information Systems Agency. Spearheading industry change through its 4 fundamentals: Secure Capabilities, Strategic C3, Modernization, and Data. Hear from the visionary himself, Lt. Gen. Robert Skinner about the strategic imperatives of this plan: https://bit.ly/3WcCrb2. Paving the way for advanced #Cybersecurity and #strategy!

26

I am observing a lot of post about the DOD CIO memo for accepting reciprocity of DOD RMF security packages. I like that the majority of the DOD is striving move in this direction. The concern is that very little members are reading CNSSI 1254 Risk Management Framework Documentation, Data Element Standards, and Reciprocity Process for NSS. A security package must be complete and sufficient enough to provide an understanding or existing and/pr potential risk to a site or system. The majority of the security packages that come across my desk do not include credible evidence specific to a system’s configuration. They include a copy and paste response from a DOD or Agency policy only and do not include the accompanying proof that DOD or Cloud Computing configurations are implemented within the guardrails of the Federal or DOD CIOs. The Joint CSA Top 10 Misconfigurations could guide system owner’s with adding system specific evidence (e.g system configurations) to prove Federal and DOD CIO policies are implemented. Once security packages start including these artifacts, I think more and more Authorizing Officials will be more inclined to accept another system owner’s security package that is complete and sufficient enough to provide an understanding of risk.

25

5 Comments

INNOVATIVE AF | Ideas are a dime a dozen... Crafting a narrative is difficult... Organizing a team is harder yet... Executing on a vision is even more infrequent... Developing a prototype is challenging... Securing resources is a formidable undertaking... Delivering a solution—at any appreciable scale—a rare feat of courage, determination, and grit... Gaining market adoption is always a hurdle... Ensuring sustainability is the ultimate test... All told, innovation is hard. But then there are moments where we get glimpses of success. It's in these moments that it's incumbent on the workforce, contemporary peers, and senior leaders alike to amplify the story—not just the monolithic achievement, but the stories of the people themselves. Say it with me: the proverbial stories of historical lore are getting tired. It's time for a refresh. Make no mistake, NIPRGPT is awesome. Even more awesome-r? The people behind it. Who are they? Collen Roller, Nick Brooks, Alexis B., and a whole host of others who you should ask about—including all the volunteers at hackathons and behind-the-scenes supporters. They each have personal stories full of insight, inspiration, and wisdom that will enable others to go faster and do even better. To that point, if there's only one axiom found in public service, it's that FOMO is real. I can just hear senior leaders in other services and agencies now, "Hey! Where's our NIPRGPT?!" This FOMO and observational precedent can be a POWERFUL tool. Witness a young person successfully empowered and in charge of something? They'll respond, "Where's my Gen Z or Millennial?!" Take liberty with a policy? They'll proclaim, "We should do that too!" The list goes on and on, which can lead to some perverse outcomes or behaviors—insert budget/technological redundancies and the oftentimes dangerous currency dealing of political capital show theater here—but when harnessed and wielded, it's, for the most part, a good thing. Like healthy sibling rivalry. And what does that lead to? More innovation, more trailblazing, more mindsets like "Yes, if..." and professional improv like "Yes, and..." Isn't that all we really want? Sure, NIPRGPT is great; there are also a lot of iterative fixes ahead, too. Don't dwell on the thing. Focus on the real takeaway: the stories of others that compel and inspire. Humans are storytellers. Tell more contemporary stories. It's a marker of progress that leads to growth and learning. Because, truly, the best form of learning is found by doing. #technology #leadership #artficialintelligence #future #innovation

56

6 Comments

With all due respect to Senator Wicker, I disagree. The United States has the world's most dominant military, a fact underscored by our technological advancements, operational capabilities, and strategic global presence. While calls for increased defense spending are well-intentioned, they often overlook the unparalleled strength we already possess. Our recent experiences have shown that perceived near-peer adversaries like Russia are far less formidable than once thought, as evidenced by their faltering invasion of Ukraine. China and Russia, despite their military posturing, are significantly consumed with domestic issues that undermine their capabilities. China grapples with economic instability and social unrest, while Russia faces economic sanctions and internal dissent. Both nations are acutely aware of the U.S.'s superior military power and are more focused on addressing their internal catastrophes than posing a credible threat to American dominance. Strategic, targeted investments will continue to ensure our security without resorting to fear-driven spending increases. https://lnkd.in/eY5qk2fT

4

DoD DIGITAL ENGINEERING I love it when DoD leadership steps out in front of the media and so clearly articulates the INTENT and VALUE of Digital Engineering approaches. Col Matt Strohmeyer nailed it. CUSTOM COMMON OPERATING PICTURE (COP) VIEWS FOR EVERY MISSION/LEADER "Instead of a single, standardized, god’s-eye-view, Col. Matthew Strohmeyer said Monday, the goal of GIDE is a constantly evolving ecoystem of different applications, analytics, and interfaces, customized to different users at every level, from four-star theater commanders to mid-grade staffer officers to junior leaders on the battlefield, that will all draw — in different ways — on the same vast pool of data, shared across the different armed services worldwide." POWER OF CLOUD COMPUTE CUSTOM COP SERVICES “the goal is not necessarily to create that one COP that can see essentially everything we have … one Common Operating Picture to rule them all,” the colonel continued. “We need to have a heterogeneous mix of mission applications to get after all the things that we are doing.” Digital Engineering Ecosystems should be typified by numerous vendors being present in an environment that is both collaborative and competitive. Each brings their People, Process, Technology mojo so the government can have access to the right tool for the right purpose. One size does not fit all and there is more than enough work for all of us to do. We're better together. OPEN-SPEC APIs TO LINK DATA & COP CAPABILITIES "Instead of a single super-standard for all data, Strohmeyer suggested, a more practical solution might be mandating Application Programming Interfaces (APIs) that automatically translate between otherwise incompatible systems. In fact, before an organization is allowed to “play” in the GIDE experiments, he said, they must provide “open and common access to data,” whether through an API or another automatic translation tool." See my post 2 days ago on this topic: https://lnkd.in/gahF6KQj AGILE APPROACHES "Adaptability requires rapid feedback from a wide range of users, so Strohmeyer’s team has accelerated their already blistering pace, adding smaller weekly workshops to their ambitious quarterly experiments" "In fact, part of the GIDE philosophy — inspired more by Silicon Valley startups than Washington bureaucracy — is an eagerness to “fail fast.” Sometimes known as “agile” development or DevSecOps, the basic strategy is to put nascent tech in the hands of real users, let them test it until something breaks, fix it quickly, and then let the users test the updated iteration until that breaks too." https://lnkd.in/g2HTRWuu

2

“The conferees agree that intelligence support to the planning and execution of cyber operations conducted below the level of armed conflict, for preparation of the operational environment, and at each level of operational art — strategic, operational, and tactical — must be substantially improved.” I could not agree more. We must arm our formations, at the lowest level, with the information to conduct #cyber preparation of the environment and become integral in the staff estimate. We struggled with this and nobody felt it was “their” task. No formation, regardless of size, should deploy without knowing the cyber environment AND their inherent weaknesses of their network overlayed by the adversary’s motives, methods and intent. But the DoD cannot do it alone and must partner with the commercial industry to provide not only the complete cyber threat intelligence picture but also one that is easily shareable across #coalitions and mission partner environments. CrowdStrike US Army Intelligence Center of Excellence (USAICoE) United States Department of Defense #mpe #indopacom U.S. Indo-Pacific Command

8

1 Comment

Attending the monthly Information Systems Security Association - Hampton Roads Chapter meeting, Tonight, the Speaker Evan L. talked about his experience when his Facebook account got hacked and how he gained access back. In this cautionary tale, the Speaker emphasized the importance of vigilant account management and the need to stay informed about security practices. I won't go into all the details, but here is a quick summary. The User received an email that his Facebook password had been changed. After completing an account recovery, he could log in and change his password, believing that it was a simple and done deal. However, this began a month-long journey to regain his account. The following were all based on his personal experience and data gathered from the logs he downloaded from Facebook. A couple of days earlier, the Hacker had already accessed his account and had been gathering information, such as his birthday, phone number, and other Personal Information. The Hacker gained access through an old email account to which the User had not paid attention. Additionally, The Hacker created and linked a Meta account to the User's account. Meta is the parent company of Facebook and Instagram, and it has a feature that allows users to log in to Facebook from within Meta. The Hacker understood the processes and knew what he was doing. The User kept going back and forth with the Hacker to gain his account. There was a point where the UserUser was so frustrated, helpless, and lost his patience that he tried to delete his Facebook account permanently, but it didn't matter since the account was attached to Meta. The Hacker was always able to gain access. Additionally, the User didn't have the password to Meta to remove it. The User eventually regained access by creating his meta and linking his Facebook account. The User wanted to state that a couple of lessons were learned.  -Facebook or Instagram should attach them to Meta -Review all your email accounts and change the password. -Don't use simple passwords -Use Multi-factor authentication(MFA) Here are some additional readings.  https://www.cisa.gov/MFA - MFA https://lnkd.in/e5NMUXNz - Meta account https://lnkd.in/eQKJVMj6 - Facebook Password https://lnkd.in/eTPBSwsg - Facebook MFA This was another great presenter that ISSA-HR was able to host. I can't wait till the next meeting. If you're in the Hampton Road Area, stop by the next meeting in July. https://issa-hr.org/about/

3

1 Comment

First step in getting 8570.1 compliant.

14

The United States Marine Corps is seeking a more agile MILCON process. According to Rear Adm. Dean VanderLey, the challenge lies in the program budget process. The current system lacks the flexibility needed to address urgent repairs or adjustments efficiently. The Corps often taps into its facilities, restoration, and modernization funds, but this comes at a cost. Col. Jeffrey L. Hammond expressed the need for prioritization due to budget limitations, stating, "We can do anything; we just can't do everything." The article highlights the trade-offs between expedited project delivery and cost. While emergency MILCON authorities exist, they generally require sacrificing other planned projects. However, through undefinitized contract action, the Marine Corps completed $400 million worth of repairs to Pacific Northwest dry docks in just four months. Rear Adm. VanderLey emphasized the importance of more authorities to enhance agility within the MILCON process. Brig. Gen. Jason Woodworth also supports the need for increased reactivity. Check out the full article for more insights on the Marine Corps' quest for an agile MILCON process. #MarineCorps #AgileConstruction #MilitaryInfrastructure #BudgetPriorities

2