Matt Singleton

As CruiseCon is not a typical #cybersecurity event, Casey Yarbrough and I recorded the below video to answer the most common questions and just describe the event. The subjects we cover include: * Why I came up with CruiseCon * How are we bringing the type of event that is typically reserved to Fortune 200 CISOs to the rest of the cybersecurity profession * The opportunities to engage and network with people at all levels * A day by day breakdown of the agenda * How to justify the event to management, if necessary * What to expect from the ship and the event As I also mentioned the entire cost to attend CruiseCon (depending upon the cabin chosen) is less than the cost of registration fees for the other major industry events. Please review the video and reach out with any questions.

38

15 Comments

I think a lot about securing critical infrastructure and operational technology (OT) environments. A few months ago, I saw a post from Andy Hollingsworth about cybersec ops training from the Idaho National Lab/CISA. I found a collection of training they have online for the Cyber-CHAMP framework. It is taught from an OT operator perspective and highlights the challenges that come with the IT/OT convergence. Cyber-CHAMP is a structured framework to help organizations assess their cybersecurity posture, align security initiatives with business goals, and develop a roadmap for building a cyber-ready workforce. What makes Cyber-CHAMP so powerful is that it looks at #cybersecurity from both the organizational and individual level. It's not just about implementing the latest technologies - it's about ensuring your people have the right skills, roles, and responsibilities to be an effective line of defense. Cyber security for OT environments used to be accomplished by creating separate networks. But that strategy doesn't hold up as more and more devices demand connectivity - including things like coffee pots which the instructors share in a memorable example during the class. Cyber-CHAMP provides a way to assess gaps and develop a tailored plan for upskilling the workforce. I am encouraging everyone on my team to take these classes. The instructors are practical and experienced. The content is up to date, relevant, and vendor agnostic. And, it is free. What's not to like? #aws AWS for Energy & Utilities #timeseries #businessanalytics

10

I received an e-mail today from NSA about their tools for the DIB entitled "Free Cybersecurity Services from DOD for Defense Industrial Base". Don't get me wrong, I am happy they are providing the tools to the DIB but it seems like the NSA tools and the Project Spectrum cloud tools they are working on for the DIB are too exclusionary. We have a lot of small businesses that are trying to get into being part of the DIB "club" and are expected to meet all the requirements that are being given out for free to companies with DOD contracts. Does this mean that if you don't have an existing contract you will not be able to afford to participate to get a contract? The companies that already have contracts have already agreed to DFARS 7012 flowdowns. The new companies are just trying to get kickstarted and the free tools are not being provided? Please, let's talk about how we can get the new companies to be part of the DIB and use the tools provided.

17

13 Comments

UA Little Rock had a problem: Organizations hesitated to report cyber incidents due to fear of reputational damage and legal risks. This led to underreporting and a lack of proactive defense. Recognizing the need for a solution, UA Little Rock turned to Dock’s Reusable Digital ID platform, Certs. They integrated it through the @US Department of Energy’s ET-ISAC to enable anonymous threat reporting. Using Dock’s advanced cryptography and Zero-Knowledge Proof technology, UA Little Rock empowered its community members to share critical insights without jeopardizing their identity. Learn more: https://lnkd.in/dg4RiU7g

3

A new bipartisan report from the McCrary Institute for Cyber & Critical Infrastructure Security offers specific and comprehensive cybersecurity recommendations to The White House' s next administration. This report goes much further and deeper than existing white papers from our national security agencies, and the writing is compelling. “The recommendations outlined in this report are not mere suggestions; they are imperatives for securing America’s future in the digital age. The threats we face are real, urgent, and growing more complex by the day. Ransomware attacks, for instance, have moved beyond mere criminal enterprises to become tools of national power, threatening our critical infrastructure and the very fabric of our society. The recent attacks on our healthcare systems, energy grids, and financial institutions are stark reminders of our vulnerabilities and the devastating consequences of inaction. Yet, the challenge before us is not insurmountable. With decisive leadership, strategic investment, and a whole-of-nation approach, we can not only defend against these threats but position the United States as the global leader in cybersecurity and digital innovation. This is not just about security; it’s about maintaining our technological edge, economic competitiveness, and national values in the digital age.” Some of my favorite recommendations: ·       Recommendation 2.2: Establish a national cybersecurity R&D coordination body ·       Recommendation 2.5: Operationalize public-private partnerships ·       Recommendation 4.2: Develop comprehensive cloud security and resilience standards and certification processes ·       Recommendation 5.2: Promote an open, interoperable internet globally ·       Recommendation 5.3: Enhance international cooperation on cybersecurity standards ·       Recommendation 6.4: Develop a national K-12 cybersecurity curriculum to build a pipeline of future cyber professionals and cyber literate citizens ·       Recommendation 7.2: Enhance supply chain security for critical technologies ·       Recommendation 8.4: Conduct a robust Continuity of the Economy Planning Read more background on the report from POLITICO: https://lnkd.in/gVUDf7yr #cybersecurity #election #nationalsecurity #economicsecurity #technology #publicpolicy

1

Key takeaways from this week's UH Cybersecurity conference https://wix.to/1p0G7r6 #HawaiiCybersecurity #HawaiiTech #CybersecurityHawaii #InfoSec #CyberDefense #HonoluluTech #NetworkSecurity #SecureHawaii #DataProtection #TechSecurity #ITSecurity #cyberhawaii

4

Great to be at the Northern Colorado ISSA Cyber & IT Summit today - packed room of Denver-area corporate and government cybersecurity & IT leaders at the Denver Federal Center talking cyber strategies for small business, NIST cybersecurity guidance & how AI can be used to attack deepfakes and cyber threats. BetterWorld Technology #cybersecurity #itstrategy

7

1 Comment

Security vendors! Consider sponsoring a student at cybersecurity camps this summer in CO. Read below for the details - your support can be vital to their success. Please reach out to me for any additional questions. #STEM #cyber #summercamps #students

24

1 Comment

The CMMC updates just keep coming—and now that "OIRA cleared proposed DFARS rule" we're one step closer to final publication. 🎆 Here's what the 48 CFR DFARS Rule will change: 1. Updates framework to enhance cybersecurity within the DIB, per the NDAA 2. Implements the DoD cybersecurity certification process, aka CMMC 3. Institutionalizes the CMMC cybersecurity practices and processes Reference: https://hubs.la/Q02L0B-j0 However, it's not time to celebrate just yet. We still need 32 CFR to clear OIRA's review process and 48 CFR finalized and published to the Register (https://hubs.la/Q02L0twm0) for CMMC to become "Final and Effective." What are your predictions? In the meantime, we're keeping our eyes out for the exciting updates to come. Stay tuned with us!

14

2 Comments

THIS IS A NATIONAL SECURITY RISK - BUT GUESS WHAT - NOBODY CARES. ''DISA DOD Network Information Center (NIC) operates G.root-servers.net, one of the thirteen logical Internet Root name servers. DISA DOD NIC cooperates with the eleven other Root Server Operators to provide authoritative data for the DNS Root Zone.'' The above makes this all the more frightening. If you DO NOT understand the implications, the below NOT SECURE DISA.mil domain, along with compromised DNS, means the U.S. Government and Military are exposed to numerous well known Cyber Attacks. This includes DNS Tampering and Abuse as highlighted earlier today when the U.S. Army lost Command Control of their digital Infrastructure on Saturday 10 October 2020. These FACTS are NOT opinions. As stubborn and uncomfortable as they may be, they are FACTS and are as a result of incompetence, errors, oversight, and total lack of personal and organizational controls, management, and negligence. The implications of these exposed Assets could NOT be any more serious... Should anyone from J3HQ or the FBI wish to contact us: [email protected] #WhitethornShield Federal Bureau of Investigation (FBI) FBI Cyber Division The White House GCHQ National Cybersecurity Coordination Center (NCSCC) #DNS #PKI #InternetSecurity

28

14 Comments

Our guest Speaker, Mr. Sam Olsen for Sandia National Labs, Cybersecurity Research and Development shading a light on "Improving system security through red teaming" He insisted that Improving system security through red teaming (i.e. authorized, adversary-based assessment activities performed for defensive purposes) can be a daunting task. It is more than breaking a system and then reporting how it was done to prevent it from happening again by less trustworthy actors. How do hackers pick their targets and how do they attack? When should I subject my product or system to a red team? How much detail do we share with them? The Information Design Assurance Red Team (IDART) methodology presents an approach which has been successfully utilized by Sandia National Labs for over a decade to assess systems of various size and complexity.

11

1 Comment

It will be interesting to see how this impacts #CMMC, especially internationally. Haven't had a chance to read it yet, but I'm looking forward to it! #cyber #cybersecurity #reciprocity #informationsecurity #infosec #DoD #NIST #NIST800171 #CMMC2

24

1 Comment

We're thrilled to collaborate with Boise State University - Cyber Operations and Resilience (CORe) program which was recently named one of the top 10 Cyber Programs in the US - to be able to bring you this Cyber Risk Quantification course. BSU has agreed to open this Graduate Course to YOU as Professional Development. What an opportunity - don't miss it. Get more information here: https://lnkd.in/e8qzBrDU #cybersecurity #cyberriskquantification #cyberprofessionals #educators #ciso #cio #cybersecurityrisk #cyberrisk #riskanalysis #CRQ #vulnerabilitymanagement #cyberattacks #cybertraining #riskmanagement #riskmodeling #cyberriskmodeling #cybercrime #cyberthreat #boisestate #boisestate

3

Goliath Cyber Security Group - CMMC For Higher Education… CMMC recently launched its 2.0 model based off the well-known NIST cybersecurity framework. The DOD’s phased rollout plan requires all organizations engaging with the DoD to be CMMC 2.0-compliant by October 1, 2025. This presents a unique challenge for higher education institutions that depend on DoD contracts and funding for essential research programs. CMMC will require schools to prove full compliance before they can apply for grant or research contracts. For many schools, this could be a huge hit financially. Three things Higher Education institutions can do to prepare....

7

🤷‍♂️ What's the difference between SPRS and CMMC 2.0? Let's break them down 👇 While both CMMC 2.0 and SPRS use NIST 800-171a as their standard, they don't serve the same purpose for defense contractors. DFARS 7019 requires contractors to assess and report their SPRS score to the government. The score shows your level of compliance but does not set a standard to meet. CMMC 2.0 Level 2 requires a third-party assessor (C3PAO) to verify an organization's adherence to all 110 controls of NIST 800-171a rev2. A CMMC verification will be a contract requirement for DoD contracts beginning in 2025.

15