Larry Leibrock

DFIR Thoughts 💭 The visibility problem. Devices are recieved and results produced while the hard work in the middle is seldom noticed. Advocate for your team, have stakeholders understand the value the lab brings. We can't afford not to. #DigitalForensics #MobileForensics #DFIR

66

6 Comments

Looking for custom Anti-Terrorism outreach? We worked with the Central California Intelligence Center with guides designed to enhance preparedness and response capabilities against various threats, focusing on critical areas of anti-terrorism. The titles include: - Active Shooter Response - Equip yourself with essential strategies to effectively respond to active shooter incidents. - Threat Awareness Guide - Stay vigilant and informed about potential threats with this detailed awareness guide. - Workplace Violence - Learn to identify, prevent, and manage incidents of workplace violence. - Behavior Threat Assessment and Management - Gain insights into assessing and managing behavioral threats to maintain a safe environment. These pocket guides are meticulously crafted to provide practical and actionable information, ensuring that individuals and organizations are better prepared to handle emergency situations. Stay safe, stay prepared, and let's work together to create a more secure community. https://buff.ly/47UDhMX #Security #SafetyFirst #AntiTerrorism #Preparedness #PublicSafety #CentralCaliforniaIntelligenceCenter

10

From Fuzzy Problems to Quantitative Solutions Bridge the gap between fuzzy risk problems and quantitative evaluation. Learn proven risk methodologies in the Certificate in U.S. National Security Risk Analysis this November. https://loom.ly/krF8WBk #NationalSecurity #RiskManagement #DataAnalysis

5

DOD issues class deviation, effective immediately, for its safeguarding covered defense information #cyber rule under DFARS 252.204-7012. This deviation amends the #defense regulation to specifically require compliance with NIST SP 800-171 rev. 2 until the deviation is rescinded. Because the pre-deviation language required compliance with the version of NIST SP 800-171 "in effect at the time the solicitation is issued," the deviation provides needed clarity as contractors not only prepare for DOD's upcoming #CMMC rule but also to avoid a compliance headache when NIST publishes rev 3 to #nist800171. #govcon

4

Stonefly: Extortion Attacks Continue Against U.S. Targets Attacks continue after indictment naming North Korean suspect. Symantec’s Threat Hunter Team has found evidence that the North Korean Stonefly group (aka Andariel, APT45, Silent Chollima, Onyx Sleet) is continuing to mount financially motivated attacks against organizations in the U.S., despite being the subject of an indictment and a multi-million dollar reward. Symantec, part of Broadcom, found evidence of intrusions against three different organizations in the U.S. in August of this year, a month after the indictment was published. While the attackers didn’t succeed in deploying ransomware on the networks of any of the organizations affected, it is likely that the attacks were financially motivated. All the victims were private companies and involved in businesses with no obvious intelligence value. read more https://lnkd.in/dtUZ2X4c #Stonefly #Attacks #ransomware #Symantec #intelligence #networks #sympro #symprobilişim #itmanager #itconsulting #itdepartment

2

With the Federal Bureau of Investigation (FBI) and other U.S. and international partners, we released joint Cybersecurity Advisory (CSA), North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs. https://go.dhs.gov/32b This advisory provides technical details on malicious cyber espionage activity associated with the Democratic People’s Republic of Korea (DPRK)’s Reconnaissance General Bureau (RGB) 3rd Bureau based in Pyongyang and Sinuiju. Publicly known as Andariel and other names, this RGB state-sponsored cyber group remains an ongoing threat to various industry sectors worldwide including but not limited to entities in the United States, South Korea, Japan, and India. Andariel actors fund their espionage activity through ransomware operations against U.S. healthcare entities. Read advisory for technical details on this activity along with recommended mitigations to protect against this threat. Learn more: https://go.dhs.gov/32b

149

4 Comments

🔍 Check Out the Latest Advisory from Cybersecurity and Infrastructure Security Agency For the technical scoop on recent activities and tips to protect yourself, be sure to read the latest advisory. It’s packed with details and recommendations to help you stay safe. Stay informed and secure! 🛡️ #CyberSecurity #TechAdvisory #StaySafe #InfoSec #SecurityTips

10

This Threat Assessment provides a comprehensive overview of ISIS attacks in Syria and Iraq in 2024. The documented evidence includes ISIS attacks on Syrian civilians, members of the SDF and Syrian Army, as well as Iraqi security forces, and showcases the continued existence and threat of ISIS in these two countries. The global coalition to defeat ISIS has conducted several operations to limit the effectiveness of the group in 2024, but they still remain active. The analysis that follows focuses on the related implications. #OSINT #ISIS #Syria #Iraq #US #DISIS #Monday https://lnkd.in/gyNzD4FA

20

ICYMI: On Thursday, the Biden-Harris administration issued a National Security Memorandum on Artificial Intelligence. I had the privilege of being present for the rollout by Jake Sullivan at NDU that morning. My initial thoughts: it's good to see the conversations around this have moved past where we were just two years ago talking about AI being the end of humanity. To be sure, there are risks - people doing bad things with AI, people doing bad things to AI, and just bad/shoddy AI. However, the risk of the United States falling behind strategic competitors both in national security applications as well as broader applications that ripple throughout our economy is far greater than any Skynet scenario we might dream up. The NSM strikes a good balance here, summed up as: we need to manage the risks prudently (and have a framework for doing so) but ABSOLUTELY need to gain and maintain the lead (not only in training better models but also directly related areas such as chips and energy). https://lnkd.in/eFwJ7yZm

8

🛡️Fortifying the Future🛡️ The National Counterintelligence and Security Center (NCSC) recently updated the National Counterintelligence Strategy to refine counterintelligence priorities in response to both current and anticipated threats. 🤝 This updated strategy aims to synchronize counterintelligence efforts across various sectors, including federal, state, local, and private sectors, aligning them with U.S. National Security objectives. The strategy emphasizes a framework for strategic planning, resource allocation, and evaluation to enhance key counterintelligence mission areas, communicated broadly to ensure comprehensive engagement and awareness. 📝 The strategy is structured around three main pillars: outmaneuvering foreign intelligence entities (FIEs), protecting U.S. strategic advantages, and investing in future counterintelligence capabilities. Supported by nine strategic goals, these pillars focus on detecting and countering foreign intelligence activities, protecting against foreign intelligence targeting and collection, and enhancing cybersecurity and critical infrastructure resilience. This framework underlines the need for ongoing vigilance, collaboration, and innovation to address the complex and evolving threats posed by foreign adversaries in the realm of intelligence and cybersecurity. 👇 Click the link below to read all the details about this latest update, then drop your thoughts on the future of national counterintelligence in the comments below! ❓ What is the most pressing threat we face currently? ❓ What future threats should we begin the preparation to face? #NCSC #counterintelligence #nationalsecurity #FIEs #foreignthreats #foreignadversaries #criticalinfrastructure #cyberthreats #cybersecurity #framework #riskmanagement https://buff.ly/3AdVvwz

1

DFARS 252.204-7012 is a Defense Federal Acquisition Regulation Supplement clause that deals with safeguarding covered defense information and cyber incident reporting. Here's a breakdown of the key aspects of this clause in bullet points: - Purpose and Scope:   - It aims to protect covered defense information that resides in or transits through contractor and subcontractor systems.  - It applies to all forms of contracts with the Department of Defense (DoD) including subcontractors where covered defense information is handled. - Definition of Covered Defense Information:  - This includes unclassified controlled technical information or other information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and government-wide policies. - Cybersecurity Requirements:   - Contractors are required to provide adequate security on all covered contractor information systems.   - Specifically, contractors must implement the security requirements specified by the National Institute of Standards and Technology (NIST) Special Publication 800-171. - Cyber Incident Reporting:   - Contractors must report any cyber incidents that affect covered defense information or the contractor’s ability to perform tasks critical to the fulfillment of a DoD program.   - Reports must be submitted within 72 hours of discovery to the DoD Cyber Crime Center (DC3). - Media Preservation and Protection:   - Following a cyber incident, the contractor must preserve and protect images of all known affected information systems and all relevant monitoring/packet capture data for at least 90 days. - Flow Down Requirement:   - The clause mandates that the requirements must be flowed down to all subcontractors that are involved in handling covered defense information. - Access to Information:   - To assess compliance with the safeguards, DoD and other authorized government operations may audit, inspect, or examine contractor and subcontractor facilities and activities. - Cloud Computing Services:   - If a contractor intends to use cloud computing services to store, process, or transmit covered defense information, they must ensure that the cloud service meets security requirements equivalent to those established by the government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline. - Training Requirements:   - Contractors must conduct awareness training for all employees to enhance protection for covered defense information and to ensure proper actions in the event of a cyber incident. This clause is a critical part of the DoD's effort to strengthen cybersecurity practices across its supply chain, reflecting the growing importance of cybersecurity in national security.

1

The Citadel Department of Intelligence and Security Studies, teamed with the Department of Political Science’s Governor John C. West Chair, will host an OSINT (Open Source Intelligence) Conference on October 23 – 25, 2024, at The Citadel Military College in Charleston, SC. https://lnkd.in/ggdRAJ2n This conference emphasizes the importance of strengthening collaboration among academia, government, and the private sector to advance Open Source Intelligence (OSINT). As outlined in the IC OSINT Strategy 2024-2026, a unified approach is essential to fully exploit the potential of open-source data, ensuring its ethical and effective use to enhance national security. The conference will focus on innovative strategies for integrating cutting-edge research from academia with the operational needs of government intelligence agencies and the technological advancements of the private sector. Key topics will include developing robust partnerships, advancing OSINT methodologies, adopting new technologies, and cultivating a future-ready workforce capable of addressing the evolving challenges within the OSINT landscape. By bringing together leading experts from these three sectors, the conference aims to foster a comprehensive and agile OSINT community. This collaboration is crucial in a rapidly changing world where the speed of technological innovation and the volume of open-source information continue to increase, necessitating a collective effort to maintain privacy, uphold civil liberties, and adhere to the highest ethical standards.

45

2 Comments

With the 2024 U.S. elections on the horizon, FBI and CISA are tackling the spread of false claims designed to undermine public trust. Their recent alert reveals how disinformation tactics aim to manipulate perceptions of voting security. Read now: https://lnkd.in/gTxNERqQ #ElectionSecurity #Disinformation #Cybersecurity #FBI #CISA #VoteSmart #US2024

2

Join Guidehouse Defense & Security's Moshe Nelson for GTSC's Homeland Security Today 2024 Terrorist Threat Forecast webinar this Thursday, May 2, where speakers will discuss identified terrorist threat trends from HSToday's Threat Forecast series. Learn more about the event and speakers: https://lnkd.in/dPH5QtzB #Guidehouse #HSToday #GTSC #Terrorism #HomelandSecurity

4

What an exciting series with big names and big topics! #GovernmentContracting #APEXAccelerator #BIGTECH #GovCon

1