John Wunder

The increasing relevance of data sanitization in classified data environments...

23

1 Comment

In my latest article for Government Technology Insider I lay out how federal agencies, including the United States Department of Defense, can leverage the latest in enterprise browsing technology to streamline their #modernization efforts and secure their missions. My point is simple: commercial browsers were not designed for mission support and the #DOD and other federal agencies deserve better. They need a browser that naturally embeds the core needs of mission support into a user experience that is fluid, frictionless, and fundamentally secure. They need browsers built for the enterprise. Click the link in the first comment below for the full article and to learn more about how an enterprise browser can help your organization address its modernization and security needs.

27

1 Comment

The transition to PQC is estimated to cost U.S. federal agencies $7.1 billion by 2035, with costs likely to increase. Sitehop demonstrated our PQC 100Gbps SAFE Series solution last year. Now that NIST has made its recommendations for PQC, we will release our solution by the end of this year. Message us to learn how you can get on the list for the first release!   #PQC #cybersecurity #future

32

1 Comment

My RSA Conference book of the month selection & review: The Declassification Engine: What History Reveals About America's Top Secrets by Matthew Connelly, published by Pantheon Books.   It’s an engaging and fascinating read, & a most important information security book.   https://lnkd.in/eennmbiC    

10

Andrew Ng’s take on California's proposed law SB-1047 is spot on: “There are many things wrong with this bill, but I’d like to focus here on just one: It defines an unreasonable “hazardous capability” designation that may make builders of large AI models potentially liable if someone uses their models to do something that exceeds the bill’s definition of harm (such as causing $500 million in damage). That is practically impossible for any AI builder to ensure. If the bill is passed in its present form, it will stifle AI model builders, especially open source developers. Some AI applications, for example in healthcare, are risky. But as I wrote previously, regulators should regulate applications rather than technology. Technology refers to tools that can be applied in many ways to solve various problems.Applications are specific implementations of technologies designed to meet particular customer needs. Safety is a property of applications, not a property of technologies (or models), as Arvind Narayanan and Sayash Kapoor have pointed out. Whether a blender is a safe one can’t be determined by examining the electric motor. A similar argument holds for AI.” #publicpolicy #policy #ai #machinelearning #ml #compliance #technology #society #sb1047 #opensourcesoftware #oss

4

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

Here's some good news for Defense Contractors: the National Security Agency is offering real help in the form of their NSA Cybersecurity Collaboration Center. I'm very excited about the NSA's 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐯𝐞 𝐃𝐨𝐦𝐚𝐢𝐧 𝐍𝐚𝐦𝐞 𝐒𝐞𝐫𝐯𝐢𝐜𝐞𝐬 offering in particular. Essentially the NSA hosts a DNS server that your organization uses to resolve internet addresses. If a URL goes to a bad place, the NSA's DNS server refuses to resolve its address and the user gets an error message that the site is down instead of downloading a virus. This breaks many attack chains in an elegant manner. Because this service is a government offering, if you are working toward CMMC compliance, this service doesn't need to be CMMC certified or FedRAMP Authorized. It counts as a Specialized Asset - Government Property. We can trust that the government will keep it secure for us. Find out more, and sign up for services, at nsa.gov/ccc #cmmc Kieri Solutions - Authorized C3PAO

55

6 Comments

Capture Management Many federal contractors now realize that having a dedicated Capture Management team is essential to winning more contracts. At GDI Consulting, we specialize in Capture Management, the secret ingredient for increasing your chances of securing federal opportunities. We can provide a complete virtual capture management service or augment your capture team to allow you to expand your company’s reach into the federal market. Here’s a quick look at the basic capture work we do to get you ahead: Opportunity Research/Tracking: We conduct thorough research to find the best opportunities that match your strengths. Competitor Analysis: We analyze your competition to identify gaps and highlight your unique value. Customer Understanding/Engagement: We help you engage directly with agencies, understanding their needs and shaping your solutions accordingly. Team Building: We provide correlation analysis and qualification vetting on candidate partners to develop the most qualified team structure. Win Strategy Development: We create a targeted plan that includes winning themes and pricing strategies that make your proposal stand out. With our team of experts, we ensure your capture process is efficient, strategic, and designed to deliver results. If you’re interested in learning more or want to schedule a consultation, feel free to reach out at mailto:[email protected]. Let’s talk about how we can help you win more contracts! 

2

1 Comment

Sandboxed recommendations that are prioritized by their risk-reduction potential are part of the foundation for strategic and programmatic cyber decisions, such as those made during risk committee meetings. The outcomes of those decisions can either be technically observed (i.e., implemented and validated via integration) or provided via user feedback (i.e., silencing because of control sustainability within a given business environment). The ultimate success story for this type of capability is enabling decision-analysis across business quarters, where three very simple questions can be answered: 1) What have we done? 2) What do we need to do? 3) How are we trending? #pelloniumriskintelligence

1

Are you using survival analysis to measure risk? You should consider it.....strongly. (I will be talking about this and MUCH more at our public training on July 17th in NYC....signup: https://lnkd.in/gnzeiCuv) Here is a "drill in" detailed example of that (this is me playing at my analytics hibachi) The data set started with 250K vulnerabilities. The team thought they were killing it... I.e. they were nearly meeting their ~30 Day MTTR Unfortunately, they were blinded by telemetry. Here's what we did next: They are in healthcare...so we focused on readily exploitable ransomware vulns. We then set a 2 month SLA (just to be very generous. It should be significantly less).... While we measured MTTR to be thorough (orange area)...it was not our target Instead, we focused on 95% or less.... (For very large orgs I would go with 99%....but it's dealers choice.) What you see in the chart is them approaching their old MTTR... If you look further to the right....there is HUGE tail territory beyond their MTTR And it's getting worse..... And remember...."The Bad Guys Like To Attack The Back Of The Herd....so patch your <expletive>!" #ciso #informationsecurity #infosec #cybersecurity #cybersecurityriskmanagement #crq #cyberriskquantification

59

4 Comments

Hello GSA Contract Holder, This is to invite you to a free informational webinar designed specifically for GSA Schedule holders interested in the upcoming GSA SCRIPTS BPA opportunity. This is a $919M multiple-award BPA opportunity with 8 awardees, with small businesses set aside and full and open tracks. SINs are 518210C, 54151ECOM, 54151S, 541614SVC, 541990RISK, and 541611. Webinar Schedule Wednesday, August 21st, 2:00 PM EST Thursday, August 22nd, 2:00 PM EST Register here: https://lnkd.in/gxGXrxCF Why You Should Attend This is an exclusive 10-year opportunity set aside for GSA Schedule holders. The final RFP is anticipated to be released in October 2024, so now is the time to prepare! What You Will Learn in the Webinar Background to the GSA SCRIPTS Opportunity: Understanding the pain points and the necessity behind SCRIPTS BPA. The SCRIPTS BPA Opportunity Explained: A high-level overview of the GSA SCRIPTS opportunity. The Proposal Requirements: A detailed discussion on how to prepare a winning proposal. The Source Selection Process: Insights into how the government's source selection process works. Partnering: How partnering can enhance your chances of success. Strategy Recommendations: Tips and strategies to increase your win probability. Q&A Session: Get your questions answered by industry experts. Register now to secure your spot in the webinar and take the first step towards winning this lucrative contract. We look forward to seeing you there!

1

What, how, and why to brief to the Board as a CISO. 🦄🏛

8

1 Comment

Is your SPRS score so low that zero would be an improvement? You’re not alone. Most defense contractors are struggling with low Supplier Performance Risk System (SPRS) scores. The current average? A dismal -12. But don’t panic — there’s hope. Your SPRS score reflects your compliance with NIST SP 800-171 and is crucial for CMMC certification. The good news: accuracy matters more than perfection. A realistic score, paired with a solid POA&M, keeps you compliant and avoids penalties. CMMC requirements begin in 2025. Start improving your score now. Read more or reach out for a free CMMC consultation — link in the comments. #CMMC #SPRS #NIST #VirginiaBusiness #VAbusiness

1

2 Comments

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

THIS IS WILD - EXPMON Public Detected a PDF "Zero-day" PoC in the wild Which Triggers a RCE Vulnerability In Adobe Reader! Adobe has been notified, will release full details after the vendor finishes their investigation. Please note: 1. This was detected by EXPMON Public (https://pub.expmon.com) when it's on a mission to analyze a huge public PDF sample set (check it out https://lnkd.in/guFBJTFD). I've "hidden" that particular submission since I realized this finding (to give Adobe the vendor a chance to review). 2. EXPMON system detected the crash and reported it as a potential zero-day attack (see picture). 3. This seems not to be a full working exploit, but a crafted PoC, at least. As I didn't see any payload in the sample. Currently not sure if it's malicious (say, a partial unfinished 0day exploit leaked), or non-malicious (crafted PDF sample for good-purpose PDF app testing?). 4. Anyway, this does bring an exploitable crash on the latest Adobe Reader, the root cause seems to be use-after-free. However, all are based on my brief analysis, need Adobe's confirmation. Sigh.. You never know what you will find in real-world samples! More importantly, I feel EXPMON is on a good mission to fill the industry gap - looking deeply into all the files from a vulnerability/exploit perspective. :) #expmon #zeroday #0day #exploit #threatintel #adobe #pdf

50

7 Comments

Misc update: I recently added a video of doing the 1st phase of the CMU binary bomb lab to the end of the #OpenSecurityTraining2 Arch1001 x86-64 assembly class, to make it easier to see how one applies the Dbg1101 Intro IDA material to that exercise. https://lnkd.in/eTf_djbt

62