David Homoney

I think a lot about securing critical infrastructure and operational technology (OT) environments. A few months ago, I saw a post from Andy Hollingsworth about cybersec ops training from the Idaho National Lab/CISA. I found a collection of training they have online for the Cyber-CHAMP framework. It is taught from an OT operator perspective and highlights the challenges that come with the IT/OT convergence. Cyber-CHAMP is a structured framework to help organizations assess their cybersecurity posture, align security initiatives with business goals, and develop a roadmap for building a cyber-ready workforce. What makes Cyber-CHAMP so powerful is that it looks at #cybersecurity from both the organizational and individual level. It's not just about implementing the latest technologies - it's about ensuring your people have the right skills, roles, and responsibilities to be an effective line of defense. Cyber security for OT environments used to be accomplished by creating separate networks. But that strategy doesn't hold up as more and more devices demand connectivity - including things like coffee pots which the instructors share in a memorable example during the class. Cyber-CHAMP provides a way to assess gaps and develop a tailored plan for upskilling the workforce. I am encouraging everyone on my team to take these classes. The instructors are practical and experienced. The content is up to date, relevant, and vendor agnostic. And, it is free. What's not to like? #aws AWS for Energy & Utilities #timeseries #businessanalytics

10

Encrypted DNS Implementation Guidance - Published by CISA in May 2024. This document provides Federal Civilian Executive Branch (FCEB) agencies with actionable guidance for the implementation of encrypted DNS protocols and for enhancing the cybersecurity posture of their IT networks. It is intended to provide implementation guidance for federal agencies to meet federal requirements related to encryption of Domain Name System (DNS) traffic and enhance the cybersecurity posture of their IT networks, as set forth in Office of Management and Budget’s (OMB) Memorandum M-22-09.1

2

We are a mighty cybersecurity awareness team! Kelly Crisp Isaac J. Galvan Ben Woelk, CISSP, CPTC, and yours truly - we've been preparing weekly for our panel at the Educause Annual Conference in San Antonio next week! If you're going to be there, be sure to attend our session on Wednesday afternoon at 1:45 - Crafting Effective Cybersecurity Awareness on Campus I'm excited to collaborate with my brilliant colleagues - we have a great discussion planned! #cybersecurityawareness #cyber #cybersecurityawarenesstraining

33

4 Comments

It's time to secure our kids' online privacy and safety. As a parent or caregiver, you shouldn't have to worry every time your child logs on. With my experience in cybersecurity, I'm the only candidate who can take real steps to protect our kids from digital threats. Oklahoma families deserve a leader who truly gets it—and who will make our kids' online safety a priority. #SecureOurKids #CyberSafety

41

1 Comment

The White House has recently introduced a comprehensive plan to address security vulnerabilities within the Border Gateway Protocol (BGP). The plan, laid out by the Office of the National Cyber Director, emphasizes the critical need for network operators and service providers to implement measures that can protect BGP from potential abuse and configuration errors. This roadmap aims to enhance the overall security posture of the internet by providing actionable steps to mitigate risks associated with BGP manipulation and exploitation. By following the guidance outlined in the plan, organizations can effectively enhance the resilience and integrity of their networks against BGP-related threats. This strategic initiative underscores the importance of maintaining a secure and stable internet infrastructure in the face of evolving cyber threats. For more detailed information, please refer to the article:

1

By 2026, every defense contractor must meet CMMC compliance to stay eligible for DoD contracts. It sounds daunting, but here’s the truth: CMMC isn’t just about compliance—it’s about protecting your business and the nation. What Exactly Is CMMC? The Cybersecurity Maturity Model Certification (CMMC) is a framework designed to ensure that companies working with the DoD have strong cybersecurity practices in place. It protects Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) from cyber threats, which are becoming more frequent and sophisticated. Think of it as a blueprint for protecting information. It’s not one-size-fits-all. There are LEVELS—ranging from basic practices to advanced controls, depending on the type of work you do. If your team handles Controlled Unclassified Information (CUI), CMMC isn’t optional. It’s essential. How Do You Start? 1️⃣ Learn the Levels: Understand which level of CMMC applies to your business (spoiler: not all require the same effort). 2️⃣ Know Your Current State: Where are your gaps? Perform a quick gap-assessment. 3️⃣ Get Expert Help: You don’t have to do this alone. Collaborate with professionals who’ve walked this path. This is more than a regulation. It’s an investment in the longevity of your business. What’s Stopping You? Drop your thoughts in the comments or DM me. #CMMCCompliance #CybersecurityForDoD #DefenseContractors #cmmc #cmmc2

9

Quick soapbox....CUI is *not* classified, but it still requires safeguarding-- meaning you should still protect it! From defense contractors to government agencies, securing CUI with encryption and fine-grained access controls is essential for compliance. (Shameless plug: Virtru makes it easy to protect CUI with client-side encryption and access policies that you control.) https://lnkd.in/exVx9YcC #CUI #DataProtection #Compliance #DownFromMySoapbox

9

Today, JTNC is working with Salesforce and DISA to enable a first-ever CAP connection for Salesforce Government Cloud Plus - Defense at the IL5 Cybersecurity Level (Controlled Unclassified Information/National Security System) and support our path to IL6 (Classified SECRET)– the latest in a ramp strategy that serves as a best practice: JTNC started with low sensitivity use cases at IL2. From there they modernized to IL4 and now are on track to complete IL5 and IL6 cloud service offerings. This strategic roadmap allows JTNC to test, validate, and mature cloud support without sacrificing time-to-market. It also makes the most of industry partnerships, giving everyone the ability to learn from one another’s subject matter expertise and accomplish more, together. In other words: JTNC’s partnership is an investment in achieving higher levels of compliance for so many DoD missions at higher classification levels to support critical/sensitive mission support.

22

1 Comment

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57

Looking to level up your Azure capabilities for HPC, AI, and ML workloads? Sycomp Storage offers rapid deployment and cost-effective storage across industries. Review benefits in this solution brief. DM us to learn how LAN Infotech, LLC can help you make the most of Azure.

2

CMMC requirements flow down from prime contractors to their subcontractors, so small businesses that are suppliers for large systems integrators have to comply as well. #CMMC Level 2 & 3 controls need a professional approach and dedicated cybersecurity personnel. They were written by cyber engineers for cyber engineers, so you’re going to need a professional on your team to implement it, and there’s no way around that. https://lnkd.in/eMSFdKRm

1

CISA released some new guidelines on best practices for event logging and threat detection. Use these to fortify your defenses. #Cybersecurity #EventLogging https://lnkd.in/eSEPp9Xu

2

If you can make please take sometime to learn more about OT Cybersecurity.

1

Last week the White House released Version 2 of the National Cybersecurity Strategy Implementation Plan (NCSIP). The Plan, which outlines actions the federal government is taking to improve our national cybersecurity posture, includes five pillars, here's what MSPs should take away from this updated cybersecurity plan, and what specifically relates to their day-to-day practices and their SMB clients.

13

1 Comment