J. Kevin Reid

Expert analysis by Drew Schmitt, Practice Lead, GRIT at GuidePoint Security, on the evolution of #RaaS. With #ransomware groups adapting recruitment tactics, the cyber threat dynamic changes. Schmitt's investigation uncovers new affiliate strategies after #OperationCronos. Learn more in his interview with Help Net Security. https://okt.to/K0ecpO #CyberCrime

4

Automated Continuous Assessments are the only way forward if we want to keep pace. Point in time assessments can’t provide the necessary assurance and significantly delay mission access to leading tech. It’s the same issue in Commercial and Jeff Buss makes a great point.

62

6 Comments

The Department of Defense released a 400-page document, "Zero Trust Overlays," which details one overlay for each of the seven pillars in the DoD Zero Trust Strategy, plus an overlay for the enablers. Learn more about this new guidance. https://bit.ly/4cb3XKU

12

This is technically the right approach but converging software factories on to a single DevSecOps platform for programs that are in mature development and fielding is going to be a lot of retrofitting that is not trivial. An open standards and open architecture approach for interoperability is probably the best bet, but standardize on a common platform all new programs moving forward. Great to see CYBERCOM starting to take their acquisition authorities to the next phase. Our adversaries are not constrained by their acquisition bureaucracies.

34

The badge is here! Quick Description: "Participants are given a series of real-world challenges that represent the skillsets most in-demand by the DoD. These challenges are designed to measure an individual's technical, analytical, and strategic abilities in the following skills categories: Forensics, Malware/ Reverse Engineering, Networking & Reconnaissance, Open-Source Intelligence Gathering (OSINT) and Web Security."

18

Understanding the Supplier Performance Risk System (SPRS) Scores 3 of 20 questions received from attendees during Week 1 of the Cybersecurity Bootcamp for Federal Contractors. "Is the SPRS used by the DoD?" Yes, the Supplier Performance Risk System (SPRS) is primarily used by the Department of Defense (DoD) to assess and manage supplier performance risks. Per DFARS 252.204-7019, defense contractors are required to report their NIST SP 800-171 self-assessment scores to SPRS. This system is a key tool for maintaining the integrity and security of defense contracts, ensuring that contractors meet the necessary compliance standards. Link to watch the full Q&A video is in the comments. Do you think a POAM should be permitted for CMMC Level 1 self-assessments?

2

1 Comment

Federal agencies, including the Department of Defense (DoD), are leaving behind cumbersome waterfall models for agile development in software projects. This shift aims to deliver rapid, mission-focused IT solutions while integrating agile acquisition methods. At REI, agile procurement means aligning with mission goals, breaking projects into manageable tasks, and ensuring flexibility and user feedback. The goal: to equip service members with effective, timely tools through efficient acquisition processes. Read more about deploying #agile practices for DoD: https://lnkd.in/eudFdJsH #ArmyAgile #agile #FederalGovernment #technology

5

For the U.S. DoD looking to integrate commercial solutions into the national security architecture, Other Transaction Agreements (OTAs) have emerged as a pivotal tool in this process. OTAs offer greater flexibility and speed, enabling quicker adoption of new and innovative technologies, bypassing some of the bureaucratic hurdles that often slow down progress in defense acquisitions. We’ll talk more about this topic on LinkedIn and in our blog over the coming weeks, as government, commercial and academic institutions determine how best to work together for national security. You can read more about how Knowmadics is empowering this process: https://lnkd.in/eDbAA8CV

32

Key considerations on ZT overlays; - rethink the perimeter - multiple attributes , multiple verifications #zerotrust #security

26

5 Comments

Good policies/SOPs, smart acquisitions terms and controls, good communications/relationships, and smart continuous monitoring are the recipe to reciprocity.

2

One of the reasons I'm excited about attending the @IPTC Photo-Metadata Conference this year is that I'm really looking forward to hearing a presentation by Neal Krawetz. Neal will be presenting a live demo of research he has gathered over the past year of how the C2PA tools (for provenance and authenticity) still have some holes in their processes. I am all about supporting missions around trust and authenticity in media - but I want to make sure I can see how to get from point A to point Z with transparency, independent governance of data and without it turning into something like digital rights management (DRM) which could lead to silos or channels of content that would only promote or allow only certain publishers to get certificates and be their own verified sources of trust. I keep wanting to use a 'right to repair' your own equipment metaphor, but what I really mean is that I want the 'right to update my own metadata' without having to go through a complex trust and authenticity system that could be hacked anyway but at the same time become the voice of authority.

1

Senate chairman wants new White House-led panel to streamline federal cyber rules Read more on the link below. #defense #sbir #military #jointwerx #cmmc #cyber #cybersecurity @jointwerx @blackhaysgroup #GovernmentContracts #InfoSec #CyberDefense #NationalSecurity #DigitalTransformation #PublicSector #Startups #TechInnovation

1

Senior Advisor at the DoD Chief Digital and Artificial Intelligence Office and Chief Product Officer of Advana, Ashley Elizabeth Evans, and others shared insights on leveraging AI/ML and automation to bolster mission readiness in defense during FedScoop's #uipathontour. The collaborative efforts between the entire CDAO, including Advana, are aimed at harnessing the potential of data and AI/ML technologies to optimize decision-making processes and operational efficiency within the DoD and defense operations. Engaging in forward-looking dialogues with other leaders such as these is essential for advancing technology within defense operations.

127

1 Comment

Update on the #CMMC timeline!  During the April The Cyber AB Town hall, Matthew Travis pointed out that CFR 48, the procurement side of the rule, was returned to the DoD and not accepted for release for public comment. The rule was originally expected out for public comment in March 2024; however since it was returned to the DoD on Apr 8 the timeline is unclear. Matt speculated that it could be a simple clerical error that could be quickly addressed enabling the rule to be released for public comment in May 2024. Public comments for CFR 32, the CMMC Program rule, are being adjudicated by the DoD. CFR 32 is still expected to be released in fall of 2024. This rule establishes the CMMC Program and authorizes assessments to begin. Therefore, it is likely that assessments can begin prior to being mandated in contracts. This will give the DoD additional fuel for including CMMC in more contracts once CFR 48 is finalized since organization will have plenty of time to get ready. Will your organization be ready for an CMMC assessment in time to beat the rush to ensure you can bid on contracts when CFR 48 is finalized?

31

3 Comments

Former CYBERCOM boss Nakasone to lead Vanderbilt defense institute Read more on the link below. #defense #sbir #military #jointwerx @jointwerx @blackhaysgroup #governmentcontracts #smallbusiness #entrepreneurship #venturecapital #consulting #strategy #leanstartups #startup #growthhacking

1

SKILLS-BASED HIRING is increasingly being adopted. Since 2109, iQ4 has invested significantly to be a market leader in Learning and Employment Record system - including a Digital Wallet that translates resumés, academic and military transcripts, and certifications into skills (professional, IT, operational/leadership) so Wallet holders can explore career pathways and get matched to vacancies. Read more in the attached article.

15

🔎Enhancing Encryption🔎 CISA just released new guidance to aid federal civilian executive branch (FCEB) agencies in implementing encrypted Domain Name System protocols to bolster their cybersecurity. ❌ This move aligns with the Office of Management and Budget Memorandum M-22-09 and the principles of the National Cybersecurity Strategy towards adopting a zero-trust framework. The latest guidance from CISA provides comprehensive directives on encrypting DNS traffic to enhance confidentiality, integrity, and authenticity, which are crucial for securing the networks of critical federal infrastructures against evolving cyber threats. To view and download a full copy of the paper, check out the link here 👉 https://buff.ly/4bmdyhZ 📡 Steps for implementation are detailed, addressing various aspects of DNS encryption across agency networks, including on-premises, cloud, and mobile environments. It emphasizes the use of CISA’s Protective DNS service as a primary DNS provider and outlines procedures to configure agency and roaming endpoints to prevent communication with unauthorized DNS providers. This framework also includes a phased implementation approach and an implementation checklist to facilitate the transition to encrypted DNS, ensuring agencies meet the encryption requirements while considering the current capabilities of existing infrastructure and vendor landscapes. 🛡️ The structured approach outlined in this guidance aims to significantly enhance the cyber resilience of federal networks by ensuring that all DNS requests are securely handled and authenticated. ❓ What best practices and procedures for DNS do you adhere to in your organization? 📣 Share your story with us in the comments below and tag a friend to hear their take! #CISA #DNS #FCEB #OMB #cyberthreats #zerotrust #framework #criticalinfrastructure #cyberresilience #unauthorizedaccess #federalnetworks #authentication https://buff.ly/4dNPWo6

3

DOD issues class deviation, effective immediately, for its safeguarding covered defense information #cyber rule under DFARS 252.204-7012. This deviation amends the #defense regulation to specifically require compliance with NIST SP 800-171 rev. 2 until the deviation is rescinded. Because the pre-deviation language required compliance with the version of NIST SP 800-171 "in effect at the time the solicitation is issued," the deviation provides needed clarity as contractors not only prepare for DOD's upcoming #CMMC rule but also to avoid a compliance headache when NIST publishes rev 3 to #nist800171. #govcon

4