Santiago Holley

New podcast is up: set phasers to "NFO" edition. Remember that "class deviation" for DFARS clause 252.204-7012? 𝗧𝗵𝗲 𝗴𝗼𝗼𝗱 𝗻𝗲𝘄𝘀: NIST SP 800-171 revision 2 is the requirement for the next several years. 𝗧𝗵𝗲 𝗯𝗮𝗱 𝗻𝗲𝘄𝘀: NIST SP 800-171 revision 2 is the requirement for the next several years. You see while 171r2 is a smaller set of requirements compared to 171r3, it's only smaller because of several questionable and often deeply unhelpful tailoring decisions that allowed the authors to make the document arbitrarily small. This week we dive into the bizarre underbelly of "NFO" controls - cybersecurity requirements that are "𝗲𝘅𝗽𝗲𝗰𝘁𝗲𝗱 𝘁𝗼 𝗯𝗲 𝗿𝗼𝘂𝘁𝗶𝗻𝗲𝗹𝘆 𝘀𝗮𝘁𝗶𝘀𝗳𝗶𝗲𝗱 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝘀𝗽𝗲𝗰𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻" with several examples: - “-1 controls” - Training Records - Independent Assessments - External Connections - Configuration Management - Incident Response Plan - The SA Family Episode links are in the comments 👇 Like ❤️ and subscribe 🔔

49

9 Comments

Learn the latest techniques in #osint! 🎓

1

If you want the #CMMC Final Rule rule distilled into a 15-minute read, without losing the actual context from the regulation, this is it. It is full of direct quotes from the rule and commentary which explain the DoD's stance on various key topics. This is the slide deck we will discuss during our webinar for the CMMC Final Rule (32CFR) today. Check comments for the link to on-demand recording. Enjoy!

153

26 Comments

Sara Friedman, thanks for the great article! DoD's ramp up plan per the draft 32 CFR Part 170 for the number of assessed orgs isn't the throughput concern. As an authorized C3PAO, we are warning clients to expect heavy market pressure from their Primes when Peak InfoSec and other C3PAOs can start doing assessments to get CMMC Level 2 Certified ASAP. We are hearing consistently that start date will be March 2025. We are already hearing subs are told by their primes to either undergo a JSVA before the start date or be ready to get CMMC L2 Certified during Phase 1. Or, be ready to be dropped from teaming groups... We are also uncertain about if and how DoD would want authorized C3PAOs to prioritize assessments. Logically, companies competing for Phase 2+ contracts and ESPs should have priority. Everyone else gets worked as the ecosystem naturally grows to handle the demand, which I believe it will. In the meantime, we recommend all DIB companies to start their C3PAO selection process now and get on the assessment schedule.

2

The US Army issued an RFI to offer a cloud-based service that could be used by SMBs. https://lnkd.in/eXB8Gre6 This is very disappointing, and for a lot of reasons. Why? Well, let’s look at what the Army has asked for. In the main “sources sought” document (https://lnkd.in/eJzTYsQ7), the Army says that it wants to offer a cloud-based system for contractors to handle CUI. It then goes on to say that the system needs to meet CMMC Level 2 requirements. There are a few problems with that. First, assuming for the moment that this was considered a “contractor information system”, then under DFARS 252.204-7012, since it is a cloud-based system, it must meet FedRAMP Moderate equivalency requirements, not “just” CMMC Level 2. How can DoD expect contractors to understand what they are supposed to do when DoD itself cannot consistently apply its own regulations? Or is this a case of DoD applying more stringent requirements on the rest of the market than on “its own” service offering? Even if, for the sake of argument, the CMMC-related language was correct (e.g., if DoD is about to adopt the CMMC Information Institute’s recommendation to shift DFARS -7012 to require CMMC compliance rather than FedRAMP), there is still the issue of CMMC Level 3. Requiring only CMMC Level 2 compliance for DoD’s cloud service means they are putting more stringent requirements on the rest of the market than on its own service offering. That is anti-competitive. And then there’s the even bigger issue. Since the cloud service would be operated on behalf of DoD, that would make it a federal information system. As such, it is subject to NIST SP 800-53/FedRAMP requirements, not CMMC. FedRAMP isn’t even discussed in the RFI. Again, how can DoD ask contractors to understand its regulations when they clearly can’t? Like I said…this is very disappointing. For a lot of reasons. I hope the Office of the Under Secretary of Defense for Acquisition & Sustainment and Office of the DoD Chief Information Officer will reach out to the US Army to get this sorted out. If they need help, there are many of us who would be happy to help them get this right. #CMMC #Cyber #FedRAMP #NIST #NIST800171

43

17 Comments

An interesting take on how China is spreading its wings of spy network till #Cuba and #Paraguay. China has a system of hacking into secure networks, which they have refined over the years. The Chinese government is also engaged in industrial espionage aimed at gathering information and technology to bolster its economy. China uses IW for transnational repression of dissidents abroad such as supporters of the #Tibetan independence movement and #Uyghurs as well as the Taiwan independence movement, the #Hong Kong independence movement, Falun Gong, pro-democracy activists, and other critics of the Chinese Communist Party.

1

Update on the #CMMC timeline!  During the April The Cyber AB Town hall, Matthew Travis pointed out that CFR 48, the procurement side of the rule, was returned to the DoD and not accepted for release for public comment. The rule was originally expected out for public comment in March 2024; however since it was returned to the DoD on Apr 8 the timeline is unclear. Matt speculated that it could be a simple clerical error that could be quickly addressed enabling the rule to be released for public comment in May 2024. Public comments for CFR 32, the CMMC Program rule, are being adjudicated by the DoD. CFR 32 is still expected to be released in fall of 2024. This rule establishes the CMMC Program and authorizes assessments to begin. Therefore, it is likely that assessments can begin prior to being mandated in contracts. This will give the DoD additional fuel for including CMMC in more contracts once CFR 48 is finalized since organization will have plenty of time to get ready. Will your organization be ready for an CMMC assessment in time to beat the rush to ensure you can bid on contracts when CFR 48 is finalized?

31

3 Comments

OSINT [1984] - Government Gaslight: The same government agencies that told you: "America's voting machines were never connected to the Internet." CISA & FBI issue bulletin that upcoming cyberattacks may "prevent the public from receiving timely information" about the 2024 election. With Election Day less than 100 days away, it is important to help put into context some of the incidents the American public may see during the election cycle that, while potentially causing some minor disruptions, will not fundamentally impact the security or integrity of the democratic process,” said CISA Senior Advisor Cait Conley. “DDoS attacks are one example of a tactic that we have seen used against election infrastructure in the past and will likely see again in the future, but they will NOT affect the security or integrity of the actual election. They may cause some minor disruptions or prevent the public from receiving timely information. It is important to talk about these potential issues now, because nefarious actors, like our foreign adversaries or cybercriminals, could use DDoS incidents to cast doubt on the election systems or processes. An informed public is key to neutralizing the impact of foreign influence operations and disinformation, which is why we put out this advisory on what a DDoS attack could – and couldn’t – do.” https://lnkd.in/eTWZY4TX

1

🚨 𝐍𝐈𝐒𝐓’𝐬 𝐍𝐞𝐰 𝐀𝐈 𝐓𝐚𝐬𝐤 𝐅𝐨𝐫𝐜𝐞: 𝐃𝐫𝐢𝐯𝐢𝐧𝐠 𝐈𝐧𝐧𝐨𝐯𝐚𝐭𝐢𝐨𝐧 𝐰𝐢𝐭𝐡 𝐒𝐚𝐟𝐞𝐭𝐲 🚨 The launch of the Testing Risks of AI for National Security Taskforce (TRAINS) by NIST highlights a critical focus on ensuring AI is safe, secure, and effective in high-stakes applications. This inter-agency collaboration indicates the growing demand for 𝐫𝐨𝐛𝐮𝐬𝐭 𝐭𝐞𝐬𝐭𝐢𝐧𝐠 𝐟𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤𝐬 𝐭𝐨 𝐯𝐚𝐥𝐢𝐝𝐚𝐭𝐞 𝐀𝐈 𝐦𝐨𝐝𝐞𝐥𝐬 𝐢𝐧 𝐝𝐞𝐟𝐞𝐧𝐬𝐞 𝐚𝐧𝐝 𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐜𝐨𝐧𝐭𝐞𝐱𝐭𝐬. Synthetic datasets are instrumental in preparing AI systems for these challenges. By enabling precise, scalable training in controlled environments, synthetic data helps ensure AI models meet the rigorous standards required for national security. As the defense sector evolves, how can your AI solutions benefit from synthetic data to enhance safety and decision-making? Let’s connect! #AI #NationalSecurity #SyntheticData #AITesting #DefenseInnovation

2

1 Comment

Attention Government Contractors! The move toward requiring NISP SP800-171 for CUI across all government contracts continues. Last week saw the release of NIST SP800-171r3, and we see rule making proceeding for FAR to finally implement the third leg of EO 13556. This means that if you're working in the government space with Controlled Unclassified Information (CUI), you will soon be contractually required to implement systems against NIST SP800-171 if not already. The good news is that NIST SP800-171 rhymes with CMMC (you have to hum it just the right way) so if your program is already tracking to those requirements your heavy lift is already in place. If not, your competition thanks you. Need help sorting this out? Give Cyber Foundry a call and we can help you put a Fractional CISO in place to guide you on the FAR CUI journey. Cyber Foundry: https://cyberfoundry.io Acquisition.Gov Regulation: https://lnkd.in/ez_M33KM New NIST SP800-171r3: https://lnkd.in/ehFf7ZN5

7

2 Comments

This is an excellent synopsis of the CMMC Final Rule. #CMMC #CUI

9

𝗕𝗔𝗪 𝗚𝗔𝗪𝗗 𝗧𝗛𝗔𝗧'𝗦 𝗖𝗠𝗠𝗖'𝗦 𝗠𝗨𝗦𝗜𝗖 11 years after Presidential Policy Directive 21 we now have the "National Security Memorandum on Critical Infrastructure Security and Resilience" The memo directs the government to do a lot of things, but this jumps out: 𝗣𝗼𝗹𝗶𝗰𝘆 𝗣𝗿𝗶𝗻𝗰𝗶𝗽𝗹𝗲𝘀 𝗮𝗻𝗱 𝗢𝗯𝗷𝗲𝗰𝘁𝗶𝘃𝗲𝘀 "It is the policy of the United States to strengthen the security and resilience of its critical infrastructure, consistent with the following principles: 𝗠𝗶𝗻𝗶𝗺𝘂𝗺 𝗥𝗲𝗾𝘂𝗶𝗿𝗲𝗺𝗲𝗻𝘁𝘀 Federal, State, local, Tribal, and territorial regulatory and oversight entities have a responsibility to prioritize establishing and implementing minimum requirements for risk management, including those requirements that address sector-specific and cross-sector risks. These requirements should also leverage existing guidance where applicable. Regulatory frameworks should be: - Risk- and performance-based when feasible - Informed by existing requirements, standards, and guidelines - Aligned to reduce unnecessary duplication - Complementary to voluntary public-private collaboration - Scalable and adaptable to an evolving risk environment. 𝗥𝗲𝗾𝘂𝗶𝗿𝗶𝗻𝗴 𝗮𝗻𝗱 𝗲𝗻𝗳𝗼𝗿𝗰𝗶𝗻𝗴 𝗺𝗶𝗻𝗶𝗺𝘂𝗺 𝗿𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲 𝗮𝗻𝗱 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝗺𝗲𝗻𝘁𝘀 and recommendations that direct building resilience into critical infrastructure assets and systems upfront, and by-design, 𝘀𝗵𝗮𝗹𝗹 𝗯𝗲 𝗮 𝗽𝗿𝗶𝗺𝗮𝗿𝘆 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗶𝗯𝗶𝗹𝗶𝘁𝘆 𝗼𝗳 𝘁𝗵𝗲 𝗙𝗲𝗱𝗲𝗿𝗮𝗹 𝗚𝗼𝘃𝗲𝗿𝗻𝗺𝗲𝗻𝘁. 𝗔𝗰𝗰𝗼𝘂𝗻𝘁𝗮𝗯𝗶𝗹𝗶𝘁𝘆 Robust accountability and enforcement mechanisms from Federal, State, local, Tribal, territorial, and private sector entities, 𝗮𝘀 𝘄𝗲𝗹𝗹 𝗮𝘀 𝗶𝗻𝗱𝗲𝗽𝗲𝗻𝗱𝗲𝗻𝘁 𝘁𝗵𝗶𝗿𝗱 𝗽𝗮𝗿𝘁𝗶𝗲𝘀, are an essential component of effective risk management for critical infrastructure. Accountability mechanisms should continuously evolve to keep pace with the Nation’s risk environment. 𝗜𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 𝗼𝗳 𝘁𝗵𝗶𝘀 𝗠𝗲𝗺𝗼𝗿𝗮𝗻𝗱𝘂𝗺 By January 2025 CISA and the various agencies need to submit a report reviewing, "the available authorities, incentives, and other tools to encourage and require owners and operators to implement identified sector-specific or cross-sector minimum security and resilience requirements." The review needs to: - Identify the most critical gaps in the Federal Government’s capacity to require and enforce minimum security and resilience requirements for critical infrastructure. - Provide the Office of Management and Budget a legislative proposal for any necessary additional authorities or capabilities that could enable the implementation of these minimum security and resilience requirements for critical infrastructure. The memo is a big deal. You should read it.

96

26 Comments

Working on a CMMCaudit .org blog about brand new defense contractors that realize they need a #CMMC Level 2 certification to start bidding. And of course, there is no spare money to be found. What are the most efficient options for them? The good news is that these companies don't have much infrastructure. Meaning that they are probably operating from a few personal laptops, with no investment in a larger IT network. They've avoided 'technical debt' - having an existing mission-critical network that never had cybersecurity as a priority (very expensive to upgrade). My initial response is summed up as... - The cost of having a NIST SP 800-171 compliant network can be viewed similarly to renting a facility or buying machinery. Just a capital requirement to win work. I do understand that CMMC certification costs could easily double the first year cost of an defense contractor that offers skilled FTEs or tech work. I'm not trying to minimize how hard this is. But lots of businesses need to get investment before they start; CMMC is just another ?$60-$100k?. It should be a huge market advantage to be certified in 2025. - I can think of a dozen vendors that have built CMMC Level 2 compliant solutions. Reaching out to those companies, rather than trying to reinvent the wheel yourself, will likely cost you 15-50% of what it would cost to in-house your compliance. For example, my (completely unscientific) estimate is that it costs $300k-800k to architect and maintain a functional small business network from scratch (almost entirely labor costs, year 1-2). In comparison: from what I've heard; CMMC-oriented Managed Services Providers will build a functional small network for you for about $70k and maintain it for ~60k a year. I also know of one vendor that offers a CMMC Level 2 virtual enclave for about $3-4k per month. Kieri Solutions - Authorized C3PAO (my company) offers a Reference Architecture (full build instructions, engineering support support, and training/instructions to maintain Level 2 compliance) for a bit less than $15k. Optionally, we can build it for you and do all the compliance actions necessary to be ready for certification. But you need to supply a smart system administrator to be responsible for the network long-term. Not for every company. My ask: If you are a vendor offering CMMC Level 2 compliant networks as a solution, please comment with your brand and give a price-range for a small network (10 users, no special technology) for year 1+2. I will delete replies that do not include a price range! If you aren't a vendor, but have some tips for how to get a certifiable network built for cheap, please also respond! I plan to summarize your offerings and ideas in a post on CMMCAudit .ORG. Here are some people you should follow (that I hope will reply): Andy Sauer Ryan Heidorn Ben Gerenstein, Glenda R. Snodgrass, CCP/CCA Bobby Guerra

105

28 Comments