Scott Miller, CISSP

Good news for DoD contractors, you can inherit controls from an authorized cloud provider. CMMC compliance isn’t a one-and-done task. Staying compliant is easier for you now while you inherit the changed controls your provider is implementing WITHOUT you needing to update yourself.  Kahua CTO Colin Whitlatch explains more in this clip. Get the full scoop on CMMC here: https://lnkd.in/gYY7ww4K #CMMC #FedRAMP #DefenseIndustrialBase #Construction  

30

1 Comment

#CMMC Compliance: A Big Challenge for Small Businesses in DIB Small and medium-sized businesses (SMBs) in the Defense Industrial Base (DIB) are facing a tough reality. CMMC Level 2 compliance isn’t just a technical hurdle—it’s an operational mountain. 1️⃣ Hashing artifacts, retaining evidence for 6 years, exporting data from cloud tools, taking endless screenshots... For SMBs with little to no IT staff, it can feel overwhelming. 2️⃣ 25% of small contractors may leave the defense market because of compliance costs. That’s not just bad for those businesses—it’s a risk to national security. So, how can SMBs stay in the game without breaking the bank? Here are 5️⃣ actionable steps that can help: 1️⃣ Start with a gap analysis. ( the sooner the better) Figure out where you stand and prioritize fixes based on risk and resources. 2️⃣ Use affordable tools. Look for cost-effective solutions like endpoint protection or automated artifact collection tools to save time and effort. 3️⃣ Partner with experts. Managed Service Providers (MSPs) can act as your outsourced IT/security team—no full-time hires needed. 4️⃣ Simplify documentation. Use templates to streamline evidence collection and focus on what matters most to auditors. 5️⃣ Educate your team. Basic cybersecurity training goes a long way in reducing risks (and impressing assessors). Thoughts? #CMMC #GOVERNMENTCONTRACTORS

2

Download OSIbeyond's DoD Contractor’s Guide to CMMC 2.0 Compliance to learn the steps DoD contractors need to take in order to prepare for, achieve, and maintain CMMC 2.0 compliance. https://lnkd.in/dtqNsHTh #CMMC #DoDContractors #CMMCCompliance

7

3 tips to get into security.

13

4 Comments

Download OSIbeyond's DoD Contractor’s Guide to CMMC 2.0 Compliance to learn the steps DoD contractors need to take in order to prepare for, achieve, and maintain CMMC 2.0 compliance. https://lnkd.in/dtqNsHTh #CMMC #DoD #DoDContractor #GovCon #Manufacturer

6

Helen Patton - These are shocking results. We need proper corporate governance for cyber resilience around the PEOPLE part of people, process, and technology. Training HUMANS for SKILLS necessary to maintain and defend our networks from our SOC Analysts to our everyday IT workers is absolutely critical if we are going to beat the bad guys. Companies that invest in people will win. Those that don’t, should lose. But the sad part is, we all lose when they do. Steps to do this the right way: 1. Adopt a job work role framework like NICE. Tweak it to meet your industry and company requirements. 2. Track all degrees, certifications, and knowledge against that framework. 3. Understand the Knowledge, Skills, Abilities, and Tasks required to fulfill each job role effectively . 4. Assess your IT and cyber workers via skills-based live lab exercises. Understand their knowledge and skills against the actual job role you’re asking them to fulfill. 5. Achieve a baseline understanding of your IT and cyber workforce to understand your organizational cyber resilience posture. 6. Create customized learning paths for each worker to achieve job role mastery and to drive career options. 7. Wash, rinse, repeat. This is a process, not a destination. 8. Spend the $! 9. Tell the world! Your shareholders will love you. We can do this. We have to do this! #cyberworkforce #cyberskills #ITworkfoce #cyberresilience #cybertraining #shareholdervalue

5

Very well thought out post regarding one of the biggest issues with the cybersecurity industry right now!

3

Hence why I make it a point to carry a battery brick with me wherever I go. I'm not *against* using these types of outlets, but they seem more of a last resort rather than an interface to avoid entirely. Of course, you could be proactive and charge your battery brick here and THEN your phone...with the brick.

2

1 Comment

If you're at Blackhat over summer, here's a Training course worth considering. Soft skills for tech people and especially Cyber Security professionals aiming for leadership roles is a must.

7

Jacob presents a simple set of guidance for implementing CMMC and the foundational security controls in SP 800-172r2 to those either currently engaged or interested in DoD contracting opportunities. The message is pretty simple: 1. compliance with the security controls in NIST 800-171r2 has been a contractual requirement for anybody who has held a contract or is holding a contract with DoD that contains the DFARS 252.204.7012 since December 31, 2017. 2. Self attestation of compliance by the DoD contractors through the SPRS system has failed, and DoD created the CMMC program to require assessments by trained, 3rd party assessors (C3PAOs and their certified assessors) to certify compliance as appropriate with NIST 800-171r2 controls. 3. The CMMC program regulations (Title 32 of the CFR) will become effective December 16, 2024. DoD contractors will be required to either self assess their compliance for safeguarding Federal Contract Information or Controlled Unclassified Information through the SPRS system or obtain a certification from a C3PAO and its team that it meets the CMMC program at Level 2. 4. The comment period on Title 48 which will make compliance for Level 2 a contract requirement will be required for contract award 60 days after its effective date in accordance with a four year phase-in period. Current forecasts begins with Phase 1 for new contracts in June 2025 and ends with Phase 4 after four years when most DoD contracts will require CMMC Level 2 certification by a C3PAO and its assessment team. 5. Jacob provides several useful resources and references throughout his blog. I encourage you to heed Jacob's Counsel on this matter, and determine where your organization falls in this discussion. I attended an earlier version of his CMMC online training and found it an excellent course and well worth the modest fee he charges.

1

1 Comment

Breaking news: A former Disney World employee was recently arrested by the FBI for allegedly hacking into company computer systems and mislabeling allergy information on menus. This incident highlights the critical importance of cybersecurity and the need for organizations to protect sensitive data, especially when it involves public health and safety. It’s a stark reminder that in today’s digital age, vigilance is key. #cybersecurity #datasecurity #publicsafety #FBI #Disney

12

1 Comment

TLDR: I passed SecurityX (CASP+) I was bedridden with COVID the day before I was supposed to take the beta test for the CompTIA SecurityX exam, and obviously wasn't going to go into the testing center to take it. After contacting Pearson VUE they wouldn't let me reschedule since it was within 24 hours of my exam and I didn't have a doctor's note since I used an at-home test. Here's the kicker: the last day to take the exam was 3 days later and it would take a week to hear back from their support to appeal it. So I scheduled (and paid again) to take the exam remotely on the last day it was available and hoped I got feeling well enough to actually be able to stare at a screen without getting a headache. I hadn't studied for the exam at all, so it was really just to see how much I've naturally absorbed through the industry, and as a checkpoint towards going after the CISSP. Somehow COVID-brained Drew was able to pull his last healthy braincells together to pass the beta exam, and get the new SecurityX (former CASP+) certification. It was definitely one of the harder exams I had taken, but still focused more on management and theory behind a sound cybersecurity program, rather than the technical implementation like Security+ or CySA+. Onward to the eventually CISSP (hopefully without a COVID brain)

241

74 Comments

A hill I’ll die on every time: NAT is a security feature. It wasn’t intended as one, it shouldn’t be used as one, but it IS one. If I go into my router and disable the firewall, then do the same on every device I own, not a single extra device on my network becomes publicly exposed. That is security. It makes it hard for users with poor cybersecurity awareness to accidentally expose devices to the entire internet. If we disabled uPNP by default, we’d see a huge drop in automated exploitation.

725

139 Comments

Tired of managing security testing across a scattered team? AttackIQ Mission Control centralizes control testing for faster remediation and improved ROI. 📅 Join Jose Barajas at 10 AM PT/12 PM CT/1 PM ET on July 18th to learn how AttackIQ Mission Control streamlines security operations for organizations. Discover how to seamlessly orchestrate testing across departments and locations, gain insights specific to your role with role-based dashboards, and simplify testing workflows for faster results. ➡ Register today and optimize your #SecurityOperations: https://bit.ly/3RZa5hw #LinkedInLive #Cybersecurity

13

Don't leave your system's security to chance. Act now to patch high-profile vulnerabilities in Cisco and CrushFTP and protect your valuable data. 🔒💻 #cybersecurity #systemsecurity #datasecurity #patching #Cisco #CrushFTP #pinedacybersecurity #securityawareness #cybersecuritymakessensehere

5

🚨 DFARS 252.204-7021 (the CMMC clause) is currently at the Office of Management and Budget (OMB) 🚨 The abstract states, "DoD is amending an interim rule to implement the CMMC framework 2.0 in order to protect against the theft of intellectual property and sensitive information from the Defense Industrial Base (DIB) sector. The CMMC framework, as defined in Title 32 of the Code of Federal Regulations (CFR), assesses compliance with applicable information security requirements. This rule provides the Department with assurances that a DIB contractor can adequately protect sensitive unclassified information at a level commensurate with the risk, accounting for information flow down to its subcontractors in a multi-tier supply chain." Once approved, the rule will be sent to the Federal Register for publication 👀 You can see the rule here: https://lnkd.in/eyP5dqre Shoutout to Eric Crusius for breaking this news! #cmmc #dod #cybersecurity

35

When you create, change or delete computer files, there are many types of data that subsequently should exist. In a similar manner, there also are types of data that should not exist, in the absence of a certain event. For example, if no sale was made, there should be no record of a transaction. If a sale was made, there should be multiple records related to that transaction (i.e. a bill of sale, a credit card charge, a reduction in inventory, etc.) When we are reviewing evidence, the two circumstances that trigger an alarm are: —when data exists… that shouldn’t exist, and  —when data does not exist… that should. In court, we sometimes have to make this crystal clear to a judge, by being both concise and specific. “Your Honor,” we might explain, “If a sales transaction was deleted, there still should be a log file for both the sale as well as the cancellation, because that is how this company’s systems work.” In some cases, unfortunately, when parties have a narrative problem, they may also try to delete or falsify data. If they do this without being fully aware of all the places that related records also exist (or must exist)... and when we spot it, they now have a bigger problem. iDiscovery Solutions #weareiDS #SubjectMatterExperts #DataStrategists #DataProblems #Testimony

26

2 Comments