Matthew Thomson

I think a lot about securing critical infrastructure and operational technology (OT) environments. A few months ago, I saw a post from Andy Hollingsworth about cybersec ops training from the Idaho National Lab/CISA. I found a collection of training they have online for the Cyber-CHAMP framework. It is taught from an OT operator perspective and highlights the challenges that come with the IT/OT convergence. Cyber-CHAMP is a structured framework to help organizations assess their cybersecurity posture, align security initiatives with business goals, and develop a roadmap for building a cyber-ready workforce. What makes Cyber-CHAMP so powerful is that it looks at #cybersecurity from both the organizational and individual level. It's not just about implementing the latest technologies - it's about ensuring your people have the right skills, roles, and responsibilities to be an effective line of defense. Cyber security for OT environments used to be accomplished by creating separate networks. But that strategy doesn't hold up as more and more devices demand connectivity - including things like coffee pots which the instructors share in a memorable example during the class. Cyber-CHAMP provides a way to assess gaps and develop a tailored plan for upskilling the workforce. I am encouraging everyone on my team to take these classes. The instructors are practical and experienced. The content is up to date, relevant, and vendor agnostic. And, it is free. What's not to like? #aws AWS for Energy & Utilities #timeseries #businessanalytics

10

CMMC - Clean-up in Isle 7, There is a consistent mess in Isle 7. Only if you have had an actual CCA perform a Mock Assessment will an OSC/OSA (Organization Seeking Certification / OSA - Organization Seeking Assessment) know what an assessment requires. (14 policies; 8 plans, 320 Assessment Objectives, 280 Artifacts) You think you are ready for your final Assessment by a C3PAO for CMMC Compliance? You're not! The CMMC Certification Process: 1. You have gone thru your Self-Assessment. (With Expert guidance) 2. Created and entered your score into the SPRS system. 3. You did a "Readiness" Project which kicked out a Gap Analysis and a POA&M. 4. You have a central library (GRC Service? Spreadsheets?) of artifacts as evidence of compliance. All assembled over many months by different contributors. (Guaranteed there is a lack of conformity.) 5. You remediated and documented everything from the POA&M. 6. Your Policies, Procedures and Evidence documents are all ready, and in order? 7. You think you are in a ready state for an Assessor to breeze through all the evidence and certify you. You schedule a C3PAO for your Assessment. 8. The Assessor will review, find issues for remediation ie: gaps. 9. Back to remediation 10. Reschedule the final Assessment 11. Rinse repeat until you are fully compliant. WHAT IF WE COULD SHORTEN THIS PROCESS AND SAVE TIME ($) AND EFFORT? DoD estimates CMMC paperwork burden at 525 hours https://lnkd.in/g48JBDEb Insert step 7.1 - Run a Mock Assessment by a CCA using an AI Based Documentation review Service that produces a POA&M that addresses the integrity of your Artifacts and Evidence in less than a week. Insert step 7.2 Remediate from POA&M items. Insert step 7.3 Re-run the Service for final readiness status. WHY? - To confirm your readiness. - To present a more palatable set of documentation to the C3PAO and accelerate Certification. - To Save countless manhours in the journey to certification. - To help streamline steps 8, 9, 10, and 11 above. NOTE: The Service will generate an immediate ROI. Improve your chances of 1st time certification by working with Gailey Solutions. Get actionable results in days, not weeks. Call Gailey Solutions for CMMC help and guidance. NOTE: We White Label this Service to Partners in the CMMC Community to help you guide your clients thru the Process.

1

Those who are following CMMC have (probably? hopefully?) heard of the DoD Procurement Toolbox and its FAQs regarding cybersecurity. If not, here is a link to the Toolbox: https://lnkd.in/eM9i3pj5 DoD published an update to the FAQs yesterday for the first time in about 4 years. There are some interesting changes, and it is also interesting to see what has not been updated. I am especially intrigued by the United States Department of Defense’s answers to Q15 and Q16. Given all the work with #CMMC and the much anticipated new rules, I would have expected them to update the answers to mention that the assessments are coming. Below is a direct link to the PDF. Thanks to Robert Metzger and Joe Scholefield, CCP for finding and posting this. https://lnkd.in/exEGfxDx

11

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

"Flipping the map" on how attackers can use MSP/RMM capabilities is invaluable to understanding how organizations might limit the impact of a compromised RMM.

7

As CruiseCon is not a typical #cybersecurity event, Casey Yarbrough and I recorded the below video to answer the most common questions and just describe the event. The subjects we cover include: * Why I came up with CruiseCon * How are we bringing the type of event that is typically reserved to Fortune 200 CISOs to the rest of the cybersecurity profession * The opportunities to engage and network with people at all levels * A day by day breakdown of the agenda * How to justify the event to management, if necessary * What to expect from the ship and the event As I also mentioned the entire cost to attend CruiseCon (depending upon the cabin chosen) is less than the cost of registration fees for the other major industry events. Please review the video and reach out with any questions.

38

15 Comments

By 2026, every defense contractor must meet CMMC compliance to stay eligible for DoD contracts. It sounds daunting, but here’s the truth: CMMC isn’t just about compliance—it’s about protecting your business and the nation. What Exactly Is CMMC? The Cybersecurity Maturity Model Certification (CMMC) is a framework designed to ensure that companies working with the DoD have strong cybersecurity practices in place. It protects Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) from cyber threats, which are becoming more frequent and sophisticated. Think of it as a blueprint for protecting information. It’s not one-size-fits-all. There are LEVELS—ranging from basic practices to advanced controls, depending on the type of work you do. If your team handles Controlled Unclassified Information (CUI), CMMC isn’t optional. It’s essential. How Do You Start? 1️⃣ Learn the Levels: Understand which level of CMMC applies to your business (spoiler: not all require the same effort). 2️⃣ Know Your Current State: Where are your gaps? Perform a quick gap-assessment. 3️⃣ Get Expert Help: You don’t have to do this alone. Collaborate with professionals who’ve walked this path. This is more than a regulation. It’s an investment in the longevity of your business. What’s Stopping You? Drop your thoughts in the comments or DM me. #CMMCCompliance #CybersecurityForDoD #DefenseContractors #cmmc #cmmc2

9

What should your Incident Response procedure look like? Like your wife writing down instructions for you to make a sandwich... Notice a few things: 🔸 Everything you will need is listed 🔸 Potentially harder to find items are called out 🔸 The list DOESN'T include silly instructions about how to spread the mayo/mustard or how to position the bread The list is detailed enough for someone (i.e. me) with at least some familiarity with the tools and environment (i.e. the kitchen) can handle the process (i.e. making a sandwich) without detailing so much that the instructions have to handle any conceivable possibility (i.e. the cat eats the bread). Your processes to handle security issues should follow the same concept - and that goes for small and large business alike! The only difference is the number of steps that are listed. And yes... my wife did actually write out instructions for me for making a sandwich. I feel the love ❤️ #security #incidentresponse #dadlife #cybersecurity

27

12 Comments

Hm. Microsoft seems to have come up with a new "security convenience" which I didn't want, and more importantly is far weaker security. Specifically when I log in it wants to send a "code" to my email account. Since September I have been getting these "codes" from people trying to log in from Turkey, China, Iran, the gang of usual idiots. Fine. However this account has (a) A strong password, (b) TOTP based MFA and (c) nothing of value. Normally it wouldn't be a problem as MS would TOTP anyone who managed to somehow guess the password.... But now apparently I can just type my email address and a "code" is sent to my personal email. Enter code, totally logged in. Bypasses password AND TOTP *and* makes it easy for random flunkies to drive me nuts with fake requests. Thanks Microsoft for continuing to waste my time and insisting on using an easily findable email address as my "username". Not sure when they started this, but it looks like it goes back to September. Edit: Hilarious update: You CANNOT REMOVE the email validation method as an appropriate auth. This basically turns Microsoft's accounts into a super weak system with a hole by default. *sigh*

14

1 Comment

A few weeks ago, Jacob Horne posted the most annoying thing about #CMMC is being told that you were already supposed to be meeting the requirements per #DFARS 252.204-7012. I 100% agree with that statement. I'm sure most reading this can relate to a scenario where they've been performing well but someone had to point out the few things they didn't do to be "perfect". Experiences I've had like that certainly got under my skin. The second most annoying thing about CMMC - being told that you need to do it for National Defense. Yes, you read that correctly. The reality is businesses in a capitalist society take action on initiatives when it makes economic sense. DFARS 7012 has a major loop hole in that language that enables businesses to circumvent #DoD's intent and negate the business driver. I'm not here to debate how many businesses read the regulation and know the loophole. The fact is it exists, and I can't blame them for not fully implementing NIST SP 800-171 - especially for SMBs. The real business driver right now is what is absolutely required for the SMB to earn a contract. SMBs don't feel like they have the resources to conduct an information security risk analysis to quantify the operational risks of their current cybersecurity posture. It can be a complex endeavor, and they're focused on grinding every day to keep the lights on and hopefully earn new business along the way. Don't get me wrong. I care deeply about the National Defense. I care about protecting our services members, about protecting the USA's way of life, and doing my part to aid in that effort. The information that individuals like Tara Lemieux share about the threats in today's world truly concerns me - I'm not a person who believes in coincidences. The thought of what could happen motivates me every day to keep doing what I do. I've also had the privilege of listening to many great speakers discuss the importance of cybersecurity for the National Defense that also motivates me to continue what I do. However......I sympathize with a common theme of many SMBs I talk to: "What good is a strong cyber posture if it makes me less competitive, increasing my chance of losing work, ultimately putting me out of business? I care about the National Defense like the next red blooded American, but I need to stay in business too." The CMMC ecosystem must understand the business drivers and communicate both technical solutions AND business strategies that can help #DIB SMBs to the cybersecurity posture they need for their business. I'll start. Cost is always a concern with every business who is going to need a CMMC Level 2 certification. The cost to design and engineer a complaint infosec program is not allowable, but costs to maintain the environment are allowable for many contractors. I'm not an accountant, but Michael Tomaselli is and he's also a cyber professional. Connect with him for a more in-depth conversation. Add more cost effective resources to the comments!

19

9 Comments

Social engineering is a low-complexity TTP used by many, not just Scattered Spider. Permiso has been alerting about Scattered Spider's TTPs because it can be used by other threat actors and victims of Scattered Spider had all the security controls (CSPM, EDR, CASB, CNAPP, SIEM) but still were compromised. All victims missed early response/ containment opportunities at IdP and SaaS layers, could have caught 3 days earlier on average, a significant window given a 3-5 day operational period. By the time an alert fires in your SIEM, if it does, the blast radius is large and damage is done. DM me to discuss common gaps in threat visibility, detection, response, and containment across IdP, IaaS, PaaS, SaaS, and CI-CD that enable social engineering and other cloud TTPs to be successful, and strategies to close these gaps. We know Scattered Spider's cloud attacks, our P0 Labs Team put out a report last year detailing the cloud attacks they responded to.

3

With the 32 CFR rule going into effect in a few days, understanding #CMMC is more important than ever. This video breaks down what CMMC is and why it matters for organizations handling FCI or CUI.   A key takeaway: CMMC compliance isn’t just about meeting requirements—it’s about protecting sensitive information and securing your eligibility for DoD contracts.   If you’re not sure where to start, this is a great place. Check it out!

2

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

Sorry I didn't post yesterday, but I was occupied finishing up my CMMC CCP training. It has been a long week and a lot of information came my way. Still trying to process it all, but what I've seen, CMMC Level 2 certification is no joke. There is a lot more to demonstrating compliance than what most people might think with the 110 practices from the NIST SP 800-171. With the objectives coming in at more than 400 and ensuring you have adequate and sufficient evidence to validate your compliance efforts, "this isn't your parents' DoD DIB anymore". I commend the efforts of the CyberAB, CAICO, DoD, and others in ensuring our country's sensitive information is being secured. It is a long time coming. (I have no doubt other government agencies are going to follow in short order.) For those who don't think these new requirements will apply to them, you might want to rethink this. Although there may only be about 300,000 contractors directly impacted, the flow-down requirements will bring an exponentially larger amount of organizations within the CMMC Ecosystem. Be ready and get prepared now. (And don't forget to implement your integrated management system.) See you next week. (This content was not written by AI and is my own opinion.)

2

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57

Cyber minimum basic skills Whether its your cyber insurance company, the government, or even your customers - more and more people are checking to see if your organization has the basic cyber skills to keep yourself (and potentially them) safe. If you work with the Federal Govt (and by extension the DoD) then there are hard due dates to not only get practices in place, but test them to ensure they work. If you are struggling with NIST800-171, PCI, SOC2, CSF, HIPAA, or CMMC Mavenspire can help. We offer the expertise to assess where you are currently, create and action plan to get you in compliance, and even provide SMARTaaS offerings around compliance and security to help you stay there. If you were going to ask - yes we also help organizations that must comply to the more advanced standards like FedRamp, HITECH, ISO 27001, and CMMC L2/L3. These are much more involved and require your organization to have a clear understanding of 'the WHY' from top to bottom.

5

CMMC Level 2 Assessment Objective: Alternative Work Sites PRACTICE: Organizations must enforce safeguarding measures for containing controlled unclassified information (CUI) at alternative work sites. ASSESSMENT: Alternative work sites may include government facilities or the private residences of employees. Organizations must define and implement safeguards to account for protection of CUI beyond the enterprise perimeter. Safeguards may include physical protections, such as locked file drawers, as well as electronic protections such as encryption, audit logging, and proper access controls. Be prepared! Your assessor could ask to: 🔍 EXAMINE a list of safeguards required for alternative work sites 🗣 INTERVIEW personnel approving use of alternative work sites 📝 TEST organizational processes for security at alternative work sites (CMMC Assessment Guide: Level 2 Version 2.11, page 186) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

47

Against conventional wisdom I prefer to hire cybersecurity engineers from outside my vertical. Why…? Most companies restrict hiring to those with direct experience with the same vertical market. E.g. healthcare companies require previous healthcare experience, finance requires finance, OT requires OT, etc. The reason I prefer to hire from other verticals is to gain new perspectives. I don’t need to hire more critical infrastructure engineers because we already have strong people, policies, and processes in place. More of the same is just that. I’m curious to see what new ideas an outsider can bring to the table. An added bonus is it expands the talent pool I’m able to draw from.

35

12 Comments