Michele Thomas

A new bipartisan report from the McCrary Institute for Cyber & Critical Infrastructure Security offers specific and comprehensive cybersecurity recommendations to The White House' s next administration. This report goes much further and deeper than existing white papers from our national security agencies, and the writing is compelling. “The recommendations outlined in this report are not mere suggestions; they are imperatives for securing America’s future in the digital age. The threats we face are real, urgent, and growing more complex by the day. Ransomware attacks, for instance, have moved beyond mere criminal enterprises to become tools of national power, threatening our critical infrastructure and the very fabric of our society. The recent attacks on our healthcare systems, energy grids, and financial institutions are stark reminders of our vulnerabilities and the devastating consequences of inaction. Yet, the challenge before us is not insurmountable. With decisive leadership, strategic investment, and a whole-of-nation approach, we can not only defend against these threats but position the United States as the global leader in cybersecurity and digital innovation. This is not just about security; it’s about maintaining our technological edge, economic competitiveness, and national values in the digital age.” Some of my favorite recommendations: ·       Recommendation 2.2: Establish a national cybersecurity R&D coordination body ·       Recommendation 2.5: Operationalize public-private partnerships ·       Recommendation 4.2: Develop comprehensive cloud security and resilience standards and certification processes ·       Recommendation 5.2: Promote an open, interoperable internet globally ·       Recommendation 5.3: Enhance international cooperation on cybersecurity standards ·       Recommendation 6.4: Develop a national K-12 cybersecurity curriculum to build a pipeline of future cyber professionals and cyber literate citizens ·       Recommendation 7.2: Enhance supply chain security for critical technologies ·       Recommendation 8.4: Conduct a robust Continuity of the Economy Planning Read more background on the report from POLITICO: https://lnkd.in/gVUDf7yr #cybersecurity #election #nationalsecurity #economicsecurity #technology #publicpolicy

1

A Senate Bill requiring Vulnerability Disclosure Reporting has been approved by committee to move forward. https://lnkd.in/ei5NcFuC Vulnerability Disclosure is an important function within an effective Secure by Design product implementation following NIST Guidelines, which is described in detail in CISA's Secure by Design Software Acquisition Guide practices located at https://cisa.gov/sag Warner said that vulnerability disclosure policies, or VDPs, “are a crucial tool used to proactively identify and address software vulnerabilities,” and that this bill would “better protect our critical infrastructure and sensitive data from potential attacks.” Energy Central also contains several articles to help understand Vulnerability Disclosure Reports using a CARFAX analogy; https://lnkd.in/eJDfA7de NOTE: NIST now refers to Vulnerability Disclosure Reports using a new name, "Vulnerability Advisory Report" for better alignment with the coordinated vulnerability standard IEC 29147:2018 https://lnkd.in/eGBrJnuK , which is also discussed in the CISA Software Acquisition Guide.

7

5 Comments

🚀 Exciting News for Defense Contractors! 🚀 The Department of Defense (DoD) has introduced the Cybersecurity Maturity Model Certification (CMMC) to bolster the safeguarding of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). This initiative is a transformative step for the Defense Industrial Base (DIB), requiring all contractors and subcontractors to adhere to rigorous cybersecurity standards prior to being awarded contracts. 🔍 Why is CMMC Important? 💪 Strengthened Security: By implementing CMMC, organizations can better defend against cyber threats and protect Controlled Unclassified Information (CUI). ✈ Competitive Advantage: Certification can enhance an organization’s credibility and open new business opportunities within the defense sector. 🤝 Collaboration & Compliance: CMMC encourages a culture of security across the supply chain, fostering collaboration between defense contractors and the DoD. If you have question connect with me #cmmc #NIST800-171 #icttariq

33

A new GAO report identifies significant concerns with the implementation of SBA’s unified certification platform. GAO writes: “GAO's analyses of SBA's efforts show that leading practices for risk management, cybersecurity, and schedule and cost estimation have not been fully implemented. Accordingly, SBA faces an increased risk of additional delays as it completes remaining work and may face challenges with addressing system issues that arise.” #SBA #govcon #governmentcontracting #federalcontracting

30

1 Comment

SUMMARY: The NSA's Cybersecurity Collaboration Center offers free, proactive cybersecurity support to businesses and federal partners to combat advanced cyber threats. MAIN POINTS: - The CCC provides free threat intelligence and cybersecurity services to private companies with DOD contracts. - Services include threat analysis, mitigation guidance, and direct incident response assistance from NSA experts. - Small and medium-sized businesses can access high-level cybersecurity resources typically reserved for national security. TAKEAWAYS: - CCC aims to bolster public-private cybersecurity cooperation. - Over 1,000 industry partners have enrolled in CCC services. - CCC processes 70 million DNS queries daily, blocking billions of malicious activities. Bailey Bickley #ccc #nsa #dibservices #dib

143

5 Comments

New Blog Post! Ensuring Security: The Crucial Role of NDAA Compliance 🔒 💻 Protects Sensitive Data 🤝 Enhances Trust 🛡️ Mitigates Security Risks ✅ Required for Federally Funded Organizations Explore why NDAA compliance is essential at https://ow.ly/C8JP50U5qr0 #NDAA #Security #Compliance #DataProtection #NationalSecurity #RiskManagement #ComplianceMatters #FederalRegulations #DataSecurity

6

Public Service Announcement: CISA Warns of Hurricane-Related Scams As Hurricane Helene approaches, the Cybersecurity and Infrastructure Security Agency urges people to remain on alert for potential malicious cyber activity. Fraudulent emails and social media messages—often containing malicious links or attachments—are common after major natural disasters. Exercise caution in handling emails with hurricane-related subject lines, attachments, or hyperlinks. In addition, be wary of social media pleas, texts, or door-to-door solicitations relating to severe weather events. Personally, I pray God's blessing everyone who is or will be affected by the Hurricane Helene. Peace be with you. https://lnkd.in/gRQERtY2

6

NIST's long-awaited #PQC standards are here, but transitioning to PQC will be a long and complex process. In our latest article for InformationWeek, Taylor Brady and I break the PQC transition down into 5 steps to help federal and commercial organizations get started today. 1️⃣ Plan for change. 2️⃣ Understand the attack surface. 3️⃣ Prioritize high-value assets. 4️⃣ Prototype critical applications. 5️⃣ Design for cryptographic agility. At Booz Allen Hamilton, we are committed to helping our clients ensure their cybersecurity remains robust against quantum threats. Learn more below. https://lnkd.in/ebJ9SUc6 #postquantumcryptography #cryptodiscovery #cryptoagility

45

Join us on Wednesday, May 29th at 8:30 AM to discover how CERT Ukraine and CISA work together to combat cyber threats! Limited tickets available - act fast! Link in bio for more details and to get tickets. #CERTUkraine #CISA #CyberDefense #Collaboration #CyberSecurity.

11

A new CIS/MS-ISAC report sheds light on #TribalSector #cyberthreats and concerns. What is keeping tribal cybersecurity leaders up at night? Link to the full report in our summary. https://bit.ly/4h7PGlr Center for Internet Security Cybersecurity and Infrastructure Security Agency #TribalOrganizations #TribalNet #Cybersecurity #CyberRisk #Ransomware #CybersecurityAwarenessMonth #CyberCrime #SocialEngineering #InformationSecurity #DataBreach #CyberMaturity #ThinkEXTEND

5

This white paper reviews the challenges many US federal agencies’ IT teams face in providing multi-tenant support across secure and nonsecure groups. https://lnkd.in/esrWFFEb #dcim #federaldatacenters #securehosting #ClimateLeader!

7

In our comments – thanks to our amazing members & the moral, policy, and grammatical support of my teammates Cassie (Leonard) Ballard and Mari Savickis – we highlighted several crucial areas for CISA to consider as they work to craft a final rule. I'll break it down. ✏️ 1) Patient Safety First: Cybersecurity is essential for patient safety. Regulatory requirements must support, not hinder, this core mission. 2) Support, Don’t Punish: We need to shift away from punishing victims of cyberattacks and focus on support and prevention. 3) Coordination is Key: Collaboration with federal agencies like HHS, OCR, and FTC is vital to avoid redundant reporting and excessive burdens on healthcare providers. 4) Reporting Clarity: The definition of "substantial cyber incident" should be clear to prevent additional strains on hospitals and healthcare systems. 5) Avoid Compliance Confusion: Ensure HIPAA timelines aren't prematurely triggered by CIRCIA Reports, which could lead to compliance challenges. 6) Shared Responsibility: Third-party service providers must be accountable for reporting cyber incidents, not just healthcare providers. 7) Minimal Data Reporting: Only essential information should be required to support cybersecurity efforts without overburdening healthcare providers. 8) Reasonable Reporting Timelines: Allow hospitals to submit supplemental reports every 72 hours or five business days to avoid prioritizing reporting over patient care. 9) Inclusive Sector-Based Criteria: Health insurance companies, TPAs, and clearinghouses must be explicitly included in the criteria to prevent gaps in security. 10) Testing Before Implementation: Web-based reporting forms should be tested in a sandbox environment to ensure effectiveness and security. 11) Security Defense Reporting: Avoid requiring extensive security architecture details in reports, which could expose sensitive information. 12) Detailed Implementation Plans: CISA needs to provide clear plans for how they will distribute and utilize the reported information to benefit the healthcare sector. I truly look forward to continuing our partnership with our friends at the Cybersecurity and Infrastructure Security Agency to strengthen the cybersecurity posture for our nation and the HPH Sector. 🤝 By addressing these points, we can better protect our hospitals and healthcare systems and ensure patient safety remains at the forefront of improving cybersecurity. #Cybersecurity #PatientSafety #Healthcare #CISA #CHIME #AEHIS #PublicPolicy

9

1 Comment

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released Encrypted Domain Name System (DNS) Implementation Guidance for federal civilian executive branch (FCEB) agencies to meet #encryption requirements for #DNS traffic and enhance the #cybersecurity #resilience of their IT networks. The guidance aligns with the Office of Management and Budget (OMB) Memorandum M-22-09 and the #ZeroTrust principles of the National #Cybersecurity Strategy. It provides #FCEB agencies with direction on implementing encrypted DNS protocols in line with M-22-09, emphasizing the advancement of the U.S. Government towards Zero Trust Cybersecurity Principles. “As the operational lead for federal cybersecurity, CISA developed this guide to assist federal agencies with understanding and implementing key actions and protocols to begin encrypting DNS traffic,” Eric Goldstein, executive assistant director for cybersecurity at CISA, said. “This guide will help agencies progress further in their zero trust security journey. CISA continues our efforts and collaboration with agencies to modernize federal agency cybersecurity successfully and securely.” https://lnkd.in/g8crPx8j

16

Join us on Wednesday, May 29th at 8:30 AM to discover the joint strategies used by CERT Ukraine and CISA for cyber defense! Don't miss out on this opportunity to learn from the experts. Link in bio for more details and to get tickets. #CyberDefense #CERTUkraine #CISA #CyberSecurity #EventAlert

14

United States Department of Defense (DOD) - Cybersecurity Maturity Model Certification Program Final Rule Published On October 11th, the final program rule for the Cybersecurity Maturity Model Certification (CMMC) Program was released for public inspection on federalregister.gov and is anticipated to be published in the Federal Register, Tuesday, October 15. The purpose of CMMC is to verify that defense contractors are compliant with existing protections for federal contract information (FCI) and controlled unclassified information (CUI) and are protecting that information at a level commensurate with the risk from cybersecurity threats, including advanced persistent threats. This rule streamlines and simplifies the process for small-and medium-sized businesses by reducing the number of assessment levels from the five in the original program to three under the new program. https://lnkd.in/eAgd9SdK

4

The proposed rulemaking by the Cybersecurity and Infrastructure Security Agency (CISA) on the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) aims to establish new requirements for critical infrastructure sectors, including the defense industrial base, to report certain cyber incidents and ransomware payments to CISA. This move is intended to enhance the nation's cybersecurity through improved information sharing and incident reporting. For DoD contractors, already subject to the Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, the impact of CIRCIA may involve additional reporting obligations, particularly concerning cyber incidents and ransomware. DFARS 252.204-7012 mandates defense contractors to safeguard covered defense information and report cyber incidents to the DoD. The CIRCIA legislation could supplement existing DFARS requirements by establishing a broader and more immediate reporting mandate to CISA, potentially including a wider range of cyber incidents beyond those currently mandated under DFARS. This means that DoD contractors might have to navigate and comply with both sets of requirements, ensuring that they report relevant cyber incidents promptly and accurately to both the DoD under DFARS and to CISA under CIRCIA. The specifics of how CIRCIA will integrate with existing DFARS obligations are still unfolding, and it will be crucial for DoD contractors to stay informed of the final rulemaking by CISA to understand the full scope of their reporting responsibilities.   📢 Public Comment Period Open Until June 3rd! 📢

9

The recent report from the DHS inspector general criticizes both the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Law Enforcement Training Centers (FLETC) for continuing to use a high-risk contractor, despite explicit instructions from DHS leadership to cease collaboration due to cybersecurity concerns. The contractor in question was found to employ poor cybersecurity practices, which put sensitive data at risk. This included personally identifiable information (PII) of thousands of federal law enforcement officers and sensitive training materials. The report highlighted several alarming failures, including the contractor's inadequate monitoring of its data center, use of outdated hardware, failure to take necessary data backups, and sharing federal data without proper authorization. Despite these issues, CISA and FLETC continued to use the contractor's software, citing the inconvenience of switching systems as justification. This decision ignored significant risks, leading to potential compromises of sensitive data and operational disruptions. This situation underscores the importance of stringent cybersecurity measures and adherence to risk management protocols. The DHS and other agencies must prioritize the protection of sensitive information, especially when dealing with external contractors. It also highlights the need for comprehensive oversight and accountability to ensure that security standards are upheld consistently across all operations. As cybersecurity threats continue to evolve, organizations must remain vigilant and proactive in addressing vulnerabilities. This incident serves as a reminder that convenience should never outweigh the imperative of safeguarding critical data. Moving forward, it is crucial for agencies to implement robust cybersecurity frameworks and enforce compliance to protect against potential breaches and ensure the integrity of their systems. #dataprotection #securitystandards #riskmanagement #infosec

2