Stefan Schober

More to read! DoD has updated the #CMMC documentation stack. Scoping Guidance(s), Assessment Guide(s), and more. Much to consider.

25

2 Comments

🚨 CMMC Update: Congressional Challenge Ahead! Congressman Gary Palmer has introduced a joint resolution (H.J.Res.221) aiming to nullify the DoD's Cybersecurity Maturity Model Certification (CMMC) Program under the Congressional Review Act. This move could impact the CMMC final rule set to take effect on December 16, 2024. What This Means: • 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗨𝗻𝗰𝗲𝗿𝘁𝗮𝗶𝗻𝘁𝘆: The resolution could halt or delay CMMC implementation. • 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗜𝗺𝗽𝗮𝗰𝘁: Ongoing debates about securing the defense industrial base. • 𝗦𝘁𝗮𝘆 𝗣𝗿𝗼𝗮𝗰𝘁𝗶𝘃𝗲: Flexibility and vigilance are crucial during this time. Next Steps: • 𝗦𝘁𝗮𝘆 𝗜𝗻𝗳𝗼𝗿𝗺𝗲𝗱: Monitor developments in Congress. • 𝗥𝗲𝘃𝗶𝗲𝘄 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗣𝗹𝗮𝗻𝘀: Be prepared for potential changes. Let's keep our community informed. Feel free to share this post and comment with your thoughts on how you see this potentially impacting our industry. #CMMC #Cybersecurity #GovCon #DoD #Compliance #NIST800171 #Congress #RegulatoryUpdates

9

1 Comment

Where's the Beef? I mean Data! Defense Information Systems Agency (DISA) leaders emphasized the importance of transparency and relevance in AI pitches! DISA advised vendors to avoid using AI just for the sake of it and instead focus on how AI features work and the data they were trained on! The key takeaway: AI solutions must be mission-specific and backed by solid, well-curated data! https://lnkd.in/eys_DJ8W Steve Wallace #Rocks Sydney Freedberg Breaking Defense #AI .

3

For years, the vulnerabilities in our defense supply chains have been well understood, yet the risks remain. The time for analysis is over—the DoD must act decisively, allocate the necessary funding, and drive real change. Until we do, these critical supply chains will stay exposed, threatening the resilience of our national defense. It’s time to transform this longstanding weakness into a strategic advantage. From the article: “The lethal detonation of hand-held pagers and walkie-talkies used by Hezbollah militants this week in Lebanon demonstrated powerful spycraft, but it also raised questions about a gaping vulnerability in the global supply chain… …Even the most sophisticated participants are often unclear on who they are relying on for critical parts and raw materials, or where the risks lie… …The clear lesson of the supply chain upheavals that accompanied the pandemic was that the longer the journey entailed in making any product, the greater the chance that something might go awry, inflicting delay and higher costs… …Now there’s a potent yet related concern: The more complicated the journey, the greater the exposure to mischief… …Every movement along the way, and every additional company brought into the manufacturing process represents an opportunity for those pursuing violent agendas to insinuate themselves into the works and weaponize the product.” https://lnkd.in/eycRgcDR

1

To attain these ambitious goals, DISA must implement a multifaceted approach that encompasses technological innovation, strategic partnerships, and robust risk management frameworks. This includes the development of advanced software-defined networking solutions, implementation of stringent zero-trust security architectures, and integration of emerging technologies such as AI and ML for predictive threat detection and response. Additionally, DISA must prioritize interoperability and data standardization initiatives to facilitate seamless information exchange across diverse systems and platforms. Industry partners looking to support DISA in these endeavors should focus on offering cutting-edge solutions in cloud services, cybersecurity, and network resilience, leveraging CRG's extensive experience and expertise to help design solutions & deliver impactful outcomes in line with DISA's mission objectives. Harness CRG's capabilities to drive innovation, deliver mission-critical solutions, and safeguard national interests. Visit https://crgroupinc.com/ or reach out to us at [email protected] to explore how CRG can empower your organization to thrive in the dynamic landscape of defense technology. #DISA #DoD #DefenseInformationSystemsAgency #cybersecurity #cloudcomputing #ITmodernization #informationtechnology #networking #softwaredefinednetworking #zerotrust #AI #machinelearning #datastandardization #missioncritical #warfighter #nationaldefense #militarytechnology #cyberdefense #cybersecuritysolutions #cloudservices #federalgovernment #governmentcontracting #USMilitary #defensecontractors #federalcontracts #technologyinnovation #networksecurity #securecommunications #interoperability #strategicpartnerships #techindustry #digitaltransformation

3

At Google Public Sector, our goal is to drive efficiency, security, and modernization across government operations. Our recent partnership with Guidehouse is one example of how we’re making this happen. Via this partnership, we’re enabling federal agencies to: ✔️ Modernize their operations while cutting their expenses ✔️ Provide fast, seamless, and secure services to their constituents ✔️ Drive mission success for government agencies. Learn more in ExecutiveBiz

56

1 Comment

Don't be shy about #CMMC, the #DoD Cybersecurity Maturity Model Certification, if you are a contractor/subcontractor with the DoD. - Its final and effective as of December 16 2024. - Audits can begin as early as January 2025. - Contracts will include requirements as of May 2025. Everyone needs an SPRS score for each Cage Code they hold. NO CONTRACTS AWARDED WITHOUT IT. Some organizations can do a self assessment over 17 controls, with no external audit. Some orgs need to cover 110 Control Objectives, with no external audit. Some orgs must cover those 110 COs AND have an external audit. Some have a lot more to do. How can we help you be compliant, and take steps to minimize what you need to do? #NIST800171

11

2 Comments

DoD's comprehensive guide and strategic roadmap to software modernization! 🛣️🗺️ DoD agencies need reliable AI-powered #cloudtechnology to conduct data discovery at scale as cases, investigations, and requests increase. 📊📈 Our latest whitepaper provides essential insights and critical steps to achieve this. Explore the importance of secure cloud-based technology and our 5-step strategic roadmap for tech adoption! 🔗 Get your copy now! ⬇️ https://hubs.la/Q02yYkSV0 #LegalTech #DefenseTechnology #eDiscovery

10

This week in Defense Tech: 1️⃣ Pentagon announces new reciprocity guidance to streamline software adaptation. “We’ve heard you loud and clear on this within the DoD. I’m not going to say this is going to solve every bit of it, but it’s going to help us a bit,” Office of the DoD Chief Information Officer John Sherman said. 2️⃣ United States Department of Defense surpasses $600M in JWCC task order awards. Google, Oracle, Amazon Web Services (AWS) and Microsoft compete for task orders under the Joint Warfighting Cloud Capability enterprise cloud program. 3️⃣ The Defense Information Systems Agency has launched a new cloud service management platform called Olympus to help defense agencies develop and mature their cloud environments. 4️⃣ Switchblade 600 drones in the running for Replicator mass production. With a 24-mile range, 40 minutes of loitering endurance and the ability to fly at speeds of up to 115 miles per hour, Switchblade 600s are built to destroy armored vehicles and other targets in multi-domain military operations. 5️⃣ Embracing and incentivizing digital methods in design and manufacturing can help the U.S. match or outpace its adversaries, a new report from the Mitchell Institute for Aerospace Studies argues—and top Pentagon and industry officials say they are working to do just that. 6️⃣ The Wall Street Journal covers how America is getting ready for space warfare. Pentagon officials open up about potential threats as China’s presence in orbit grows and Russia shows interest in gear that can destroy satellites. 7️⃣ United States Space Force is getting a cloud-based, classified environment for industry collaborations. The Space Force recently extended General Dynamics Information Technology's contract to expand Project Enigma, adding more stakeholders and cloud service providers to the digital environment. 8️⃣ US Army lays out strategy for new $1B contract vehicle for modern software development. The service is seeking feedback from industry. 9️⃣ Losing hearts and minds: The desperate state of US influence operations. The United States is surrendering ground to Russia and China’s propaganda machines. That has key officials increasingly worried. 🔟 Anduril Industries is building out the Pentagon’s dream of deadly drone swarms. The US military aims to maintain its dominance by building autonomous attack drones that collaborate with humans and overwhelm defenses in swarms. 🔗 Links in comments below 👇 #DoD #DHS #defenseinnovation #defense #defensetechnology #technology #tech #nationalsecurity #jadc2 #army #navy #airforce

13

12 Comments

🚀 Exciting news from the Defense Information Systems Agency (DISA)! 📢 DISA's Chief Data Officer, Caroline Kuharske, announced at the AFCEA International's TechNet Cyber conference that DISA is preparing to unveil an updated data strategy that will cover fiscal years 2025 through 2027. This new strategy will build upon the existing data strategy and focus on integrating data governance and policies into the backend systems. The previous data strategy, implemented from 2022 to 2024, aimed to improve data architecture and enable transparency and data sharing. DISA is now in the final stages of implementing this plan and transitioning to an integrated data architecture. But they're not stopping there! The upcoming strategy will also include initiatives to integrate emerging technologies, such as artificial intelligence (AI), into data operations. DISA will collaborate with its emerging tech directorate and leverage AI for data reporting and automation. This aligns perfectly with the Department of Defense's Chief Digital and Artificial Intelligence Office's 2023 Data, Analytics, and Artificial Intelligence Adoption Strategy. But DISA isn't working alone. They will gather insights from the DoD CDAO and partner with U.S. Cyber Command and JFHQ-DoDIN to deliver critical and actionable data to the warfighter. It's all about leveraging the power of data and AI to support our defense forces and ensure their success. This is an exciting step forward in the world of data strategy and technology integration. DISA's commitment to innovation and collaboration is commendable, and it's great to see them embracing the potential of AI and emerging technologies. Let's stay tuned for the official unveiling of DISA's updated data strategy in the coming months. I'm sure it will pave the way for even greater advancements in data governance and operations. What are your thoughts on this news? How do you think AI and emerging technologies will impact data operations in the defense sector? Share your insights in the comments below! 👇 #DISA #datastrategy #AI #emergingtechnologies #defenseindustry #innovation

1

This is technically the right approach but converging software factories on to a single DevSecOps platform for programs that are in mature development and fielding is going to be a lot of retrofitting that is not trivial. An open standards and open architecture approach for interoperability is probably the best bet, but standardize on a common platform all new programs moving forward. Great to see CYBERCOM starting to take their acquisition authorities to the next phase. Our adversaries are not constrained by their acquisition bureaucracies.

35

Next week Xage Government returns to Charleston for #CDCAEasternDefenseSummit 2024 - you can find us in booth #722 sharing all things Zero Trust for mission critical operations. Swing by to meet with the team and learn more about how we secure tactical, operational, and strategic critical assets from the edge to the core to assure mission success. Learn more about the conference here: bit.ly/4g0ckLw

11

Watch the AIPCon 5 live stream today if you want to hear how leading organisations are able to operationalise AI at enterprise scale.

8

stackArmor has developed an ATO for AI governance model and the first AI Risk Management Center of Excellence designed to help Federal agencies deploy safe, secure AI-powered technologies, while meeting deadline requirements for Office of Management and Budget’s M-24-10… Read here for great insights on the necessary steps for navigating the roadmap for AI #riskmanagement in #Government: https://carah.io/c320ec   Gaurav Pal, Fawad Siraj, Martin Rieger, Bunmi Olukoya, Kristen Page, Dave Musci, Brian J. Rupert, Ryan Mishoe, Linda Mascolo, Michael Adams, Drew Scherer #stackArmor #Governance

56

The US #Navy just issued an article detailing the success of their #ZeroTrust implementation for Flank Speed. The top line is that the #security environment they’ve developed achieved 100% (91 of 91) of the Zero Trust Target level activities and nearly 100% (60 of 61) of the Advanced ZT level activities outlined in the Department of Defense’s Zero Trust strategy. As a result, the US Navy is well ahead of the Department’s 2027 goal for implementing Zero Trust at a Target activity level within their systems.   Our team is honored to support the Navy's deployment and configuration of Microsoft security solutions for Flank Speed and help DoN achieve this historic milestone. This is a testament to the defenders within DoN who are working tirelessly to deploy a comprehensive and integrated solution to protect their systems and personnel. If you want to learn how to implement a similar solution in your department or agency, see our implementation guide here: https://lnkd.in/gSxmS8uN #ZeroTrust #DoD #Microsoft #CyberSecurity Nadia Matthews, Steve Faehl, Gregory Knepper

105

4 Comments

Vendor Provided Containers - Part 4 The "Vendor Dependency Conundrum". So you do FedRAMP or DOD/IL* work and you have a POAM (Plan of Action and Milestones). For the folks who don't do Public Sector work, this is basically a list of all of your compliance violations and vulnerabilities. What happens when you have a vulnerability in a vendor provided container? Specifically for something the vendor doesn't produce or patch? Often companies will make this a "Vendor Dependency". A "Vendor Dependency" is basically saying, "we'll wait until the upstream vendor patches it". But lets be real for a moment. The choice to use the "Vendor Provided Container" is yours and yours alone. Making it a vendor dependency is passing the responsibility for something that is most definitely the responsibility of the Cloud Service Provider (the authorized service). I described in my previous posts how vendor provided containers are woefully inadequate for production use (not hardened, not stripped, missing FIPS, etc). Long story short, the burden is still on the Cloud Service Provider (or consumer of those containers) to do all of the above. So while vendor provided containers are good to get started, they shouldn't be anywhere near a production environment. Going forward we need vendors to move past creating "development" containers, because that's really all they're good for. We need a standard for containers coming from vendors and if vendors are truly pursuing their CISA pledge of Secure by Design, they would harden them and strip them according to best practices. If they want to make it easy for DOD/FedRAMP customers, they would STIG harden them, and provide them with valid FIPS libraries. In summary, don't use vendor provided containers. You need to build your own or work with a vendor that builds and hardens container images as a service. Building your own images has a real cost to it too. It's also a discipline to do it fast and do it well. Teams are not usually equipped to take this on and often haphazardly do this work.

19