Jack Daniel

Hello GSA Contract Holder, This is to invite you to a free informational webinar designed specifically for GSA Schedule holders interested in the upcoming GSA SCRIPTS BPA opportunity. This is a $919M multiple-award BPA opportunity with 8 awardees, with small businesses set aside and full and open tracks. SINs are 518210C, 54151ECOM, 54151S, 541614SVC, 541990RISK, and 541611. Webinar Schedule Wednesday, August 21st, 2:00 PM EST Thursday, August 22nd, 2:00 PM EST Register here: https://lnkd.in/gxGXrxCF Why You Should Attend This is an exclusive 10-year opportunity set aside for GSA Schedule holders. The final RFP is anticipated to be released in October 2024, so now is the time to prepare! What You Will Learn in the Webinar Background to the GSA SCRIPTS Opportunity: Understanding the pain points and the necessity behind SCRIPTS BPA. The SCRIPTS BPA Opportunity Explained: A high-level overview of the GSA SCRIPTS opportunity. The Proposal Requirements: A detailed discussion on how to prepare a winning proposal. The Source Selection Process: Insights into how the government's source selection process works. Partnering: How partnering can enhance your chances of success. Strategy Recommendations: Tips and strategies to increase your win probability. Q&A Session: Get your questions answered by industry experts. Register now to secure your spot in the webinar and take the first step towards winning this lucrative contract. We look forward to seeing you there!

1

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

Check out this podcast interview with me just after my TribalNet keynote in Vegas recently. I was asked a random question at the end about the first concert I attended that you might find interesting (and it's not just what's listed in the podcast description). #infosec #CISO #CIO #businessleaders #cybersecurity #podcast #keynotespeaker #backtobasics #rockconcerts #ISAC

5

To news organizations looking to siphon more revenue from readers with paywalls: Content paywalls do not automatically lend credence or credibility to the content you are fronting as news. The fair and balanced aspects of your content, along with legitimate research and analysis, accomplish that goal.

3

2 Comments

A recent incident serves as a stark reminder of why we need to be vigilant about who has access to our systems… A former employee of NCS in Singapore was recently sentenced after illegally accessing his ex-employer’s systems and deleting 180 test servers. This act of revenge cost NCS a whopping $678,000. The employee’s access should have been revoked immediately after his termination, but due to an oversight, he retained a login. This enabled him to wreak havoc over several months, ultimately leading to significant financial damage and operational disruption. What can we learn from this? - Revoke access immediately: Ensure that access credentials are deactivated as soon as an employee leaves the company. This should be a standard part of your offboarding process. - Regularly audit access: Conduct periodic reviews of who has access to what. Even current employees should only have access to the information and systems necessary for their role. - Implement stringent controls: Use multi-factor authentication (MFA) where you get a code on another device to prove it’s you. Other security measures add layers of protection. This makes unauthorized access much more difficult. - Monitor and enhance: Keep an eye on your systems and regularly update your security protocols. Stay informed about the latest security practices and adapt as necessary. Remember, a small oversight can lead to huge losses. When did you last review who has access to what? If it’s been more than a few months, it’s time to get to work. My team can help if needed. Send me a DM. #CyberSecurity #BusinessSafety #AccessControl https://lnkd.in/eWFSv9Cw

3

I hope everyone is having a good Friday. Time for some Sa(a)S. We're continuing the CMMC series with a more detailed breakdown of the 3 levels. The full post can be seen here: https://lnkd.in/g-DCGGi2 For a quick summary, all 3 levels are from NIST SP 800 171 (and 172 for level 3), so it's at least not completely new standards. And why the standards are still in the rule-making process, we have a good idea what the final requirements will be. Level 1 will have 17 requirements and is intended for the least sensitive DoD contracts. This certification will be based off of a self assessment. Level 2 has a big jump to 110 total requirements as more national security implications are expected with the associated contracts. This is expected to be the most common level, and in most cases will require a 3rd party assessment every 3 years with an annual self assessment. Level 3 is for the most sensitive contracts that don't involve classified (or greater) designations and will add up to an additional 35 requirements above level two. For this, companies will need to have Federal officials perform the assessment every three years. Please reach out with any questions and have a great weekend! #cmmc #cybersecurity #securityawareness

8

Not sure if people are grasping that the statements made by DOGE, the Musk/Ramaswamy Department Of Government Efficiency, would mean they are eliminating the Department of Justice. In a chart shared by WAPO (gift link below, I subscribe), they illustrate a cut of $35.5 Billion to DOJ. The entire DOJ’s 2025 Budget request, totaling $37.7 Billion. The FBI is only $11.3 Billion of that, most of which is personnel. With a staff of 36,100, of which only 13,000 are dedicated to investigating federal crimes. Most of the manpower of the FBI is dedicated to their intelligence (6,285 FTE) and counter-intelligence (13,867) services. They are the primary intelligence agency for domestic intelligence and countering the efforts of our foreign adversaries operating in the United States. Are they seriously talking about closing the FBI? Actually that was one of Ramaswamy’s campaign pledges. In an ad from the American Exceptionalism PAC” Vivek is shown saying of the FBI “we will not just reform them, we will shut them down.” https://lnkd.in/gp6H_Z_P But that’s not all. DOJ also includes the Bureau of Prisons, with their 20,000 correctional officers. The U.S. Attorney’s program, ($2.8 Billion with 6200 attorneys) the Drug Enforcement Agency ($2.6 Billion with 3600 agents), and the U.S. Marshalls ($3.8 Billion with 3960 agents) are also part of the DOJ! #FBI #DOJ #DOGE #Musk #Ramaswamy #DEA #Russia #China #intelligence #USCourts #Attorneys

23

4 Comments

It's time to quit using social security number as a password Noone is allowed access to medical or financial resources based on knowing a name.  It should be the same for SSNsIt's time to publish SSNs to keep companies from using them as a password.https://https://lnkd.in/gf6A8gTN

6

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

Incident reporting is really important at all levels. End user self reporting is crucial and often overlooked. https://lnkd.in/dgVj5hZa

5

Are we lying to ourselves? I had a wonderful coffee and conversation with Dana Wolf of YeshID yesterday and our discussion turned to fine-grain controls. Which got me to thinking about why current state security solutions and architectures are so bad at repelling the bad guys. And it has to do with atoms. Atomizing and democratizing the tech stack is our evolutionary curve. We have atomized and virtualized massive parts of the digital estate down to APIs, microservices and many other forms of bits and widgets. If this is doubted - take a look at the horizon. Quantum computing isn’t atomizing - it is sub-atomizing. Literally by definition and design. Code at the photoelectric quantum state level. You know what hasn’t been atomized? Security. The vast majority of security solutions still operate at the coarse-grained level. Authentication? IP blocking? Role and profile? Block/allow? Rules based? Policy based? All are coarse-grained security approaches to an already atomized and fine-grained digital world. Coarse-grained has been proven to be easy to break - and fine-grained is where the bad guys reap all their rewards. So - are we lying to ourselves buying and continuing to leverage coarse-grained security solutions against a fine-grained weaponized enemy?

14

7 Comments

I was looking for an open source alternative for a tool this morning and it led to a conversation with a fellow practitioner. Bottom line: the state of open source security tooling seems to be really bad now vs. when we entered the industry 10-20 years ago. It seems more and more tools are built for making a quick buck vs. building a personal brand and seeking the common good of making the internet a safer place. This is not ubiquitous, but it certainly seems to be the trend. When I first got into security, people were all about sharing, networking, and community. This led to wonderful careers where we enjoyed not only financial success, but even more so, relationships and the joy of leaving things better than we found them. I still give the vast majority of the code I write away, but it is becoming increasingly harder to find useful open source tooling. This conversation reminded me of a keynote I gave on a similar topic a few years back. It seems to apply as much today as it did then. https://lnkd.in/eTVBCka9

23

4 Comments

Here's some good news for Defense Contractors: the National Security Agency is offering real help in the form of their NSA Cybersecurity Collaboration Center. I'm very excited about the NSA's 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐯𝐞 𝐃𝐨𝐦𝐚𝐢𝐧 𝐍𝐚𝐦𝐞 𝐒𝐞𝐫𝐯𝐢𝐜𝐞𝐬 offering in particular. Essentially the NSA hosts a DNS server that your organization uses to resolve internet addresses. If a URL goes to a bad place, the NSA's DNS server refuses to resolve its address and the user gets an error message that the site is down instead of downloading a virus. This breaks many attack chains in an elegant manner. Because this service is a government offering, if you are working toward CMMC compliance, this service doesn't need to be CMMC certified or FedRAMP Authorized. It counts as a Specialized Asset - Government Property. We can trust that the government will keep it secure for us. Find out more, and sign up for services, at nsa.gov/ccc #cmmc Kieri Solutions - Authorized C3PAO

55

6 Comments

Read this important advisory from CISA regarding Operational Technology and Industrial Control Systems vulnerabilities. #ICSsecurity #OTsecurity

13

1 Comment

Google has rolled out new bulk sender authentication requirements, and some Outlook emails are getting flagged as spam. There's a workaround: Add an Outlook .com alias to your account so you can email Gmail accounts #Microsoft #Gmail #Outlook

3

Are you a contractor that uses an external cloud service provider (CSP) to store, process, or transmit sensitive defense information? DFARS clause 252.204-7012 details several requirements you must “require and ensure” meet security requirements (Are they on FedRamp.gov Marketplace?) or provide evidence that they are 100% equivalent to the FedRAMP moderate baseline. They must comply with all DFARS 252.204-7012 requirements for: Cyber incident reporting Malicious software Media preservation and protection Access to additional information and equipment necessary for forensic analysis Cyber incident damage assessment You can read the requirements yourself here: https://lnkd.in/gb7qEeaq. Or give us a call at MNS Group. We’re an Authorized C3PAO that can help provide guidance. #DoD #compliance #contractors #cybersecurity #assessment

43

1 Comment

Useful tips for CUI scope management for CMMC.

4