Tracy Reed, CISSP, CMMC CCP, CCSK, RHCE, ATP

New proposed amendments to the Defense Acquisition Regulations Supplement (DFARS) are scheduled for publication on August 15, 2024. These changes focus on updating the Cybersecurity Maturity Model Certification (CMMC) requirements for contractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). The comment period on the proposed DFARS rule will close on Oct. 14. Key Amendments in Policy (DFARS 204.7502) * Contractors must present a current CMMC certificate or CMMC self-assessment results at the required level during contract award. * This requirement applies to all information systems that process, store, or transmit FCI or CUI. Contracting Procedures (DFARS 204.7503) * Contracting officers must verify in the Supplier Performance Risk System (SPRS) that the contractor has posted a current CMMC certificate or self-assessment before awarding contracts, exercising options, or when new DoD UIDs are issued. * The successful offeror must also affirm continuous compliance with the security controls specified in 32 CFR part 170. Definitions Update (DFARS 204.7501) * A new definition for CUI, based on 32 CFR 2002, is included. * Definitions for "current" in relation to CMMC and DoD UID are also added. New DFARS Provision (252.204-7YYY) * A new provision, Notice of Cybersecurity Maturity Model Certification Level Requirements, informs offerors of the required CMMC level and mandates that CMMC certificates or self-assessment results be posted in SPRS. * Level 1 and Level 2 self-assessments must be posted by the offeror, while Level 2 and Level 3 assessments are transmitted to SPRS by third-party assessors and DoD assessors, respectively. * Successful offerors must provide DoD UIDs for contractor systems handling FCI or CUI. Updates to DFARS Clause 252.204-7021 * The clause now includes definitions for CMMC, "current" (as it relates to CMMC), and DoD UID. * Contractors must maintain the required CMMC level throughout the contract duration and submit relevant DoD UIDs to the contracting officer. * Annual affirmations of continuous compliance with security controls must be completed and maintained, along with notifications to contracting officers about changes in contractor systems or lapses in CMMC certification. * Subcontractors must also comply with the appropriate CMMC level before awarding any subcontracts. Contractor Responsibilities and Compliance * Contractors must ensure that data is only transmitted through systems certified at the required CMMC level. * Contractors are required to notify the contracting officer if any changes in certification levels occur that could affect contract performance. * The Department of Defense evaluated different options for CMMC certification timing, ultimately requiring certification at the time of award to balance risks and benefits. #cybersecurity #CMMC #DoD #compliance

8

1 Comment

Southern California study finds high levels of airborne plasticizers

1

Quick home lab updated: This tool is pretty neat, I started running it against my home cluster more for troubleshooting but also to gain a better understanding of the attack surface. I've been grinding alot at work lately, hope to have some new content out closer to the end of the year. #kubernetes #cloudnative #k3s #security

2

I think a lot about securing critical infrastructure and operational technology (OT) environments. A few months ago, I saw a post from Andy Hollingsworth about cybersec ops training from the Idaho National Lab/CISA. I found a collection of training they have online for the Cyber-CHAMP framework. It is taught from an OT operator perspective and highlights the challenges that come with the IT/OT convergence. Cyber-CHAMP is a structured framework to help organizations assess their cybersecurity posture, align security initiatives with business goals, and develop a roadmap for building a cyber-ready workforce. What makes Cyber-CHAMP so powerful is that it looks at #cybersecurity from both the organizational and individual level. It's not just about implementing the latest technologies - it's about ensuring your people have the right skills, roles, and responsibilities to be an effective line of defense. Cyber security for OT environments used to be accomplished by creating separate networks. But that strategy doesn't hold up as more and more devices demand connectivity - including things like coffee pots which the instructors share in a memorable example during the class. Cyber-CHAMP provides a way to assess gaps and develop a tailored plan for upskilling the workforce. I am encouraging everyone on my team to take these classes. The instructors are practical and experienced. The content is up to date, relevant, and vendor agnostic. And, it is free. What's not to like? #aws AWS for Energy & Utilities #timeseries #businessanalytics

10

CMMC Level 2 Assessment Objective: Data in Transit PRACTICE: Organizations must implement cryptographic mechanisms to prevent unauthorized disclosure of controlled unclassified information (CUI) during transmission unless otherwise protected by alternative physical safeguards. ASSESSMENT: The intent of this requirement is to ensure CUI is cryptographically protected during transit, particularly on the internet. The most common way to accomplish this is to establish a transport layer security (TLS) tunnel between the source and destination using the most current version of TLS. Because the use of cryptography in this requirement is to protect the confidentiality of CUI, the cryptography used must meet the criteria specified in requirement SC.L2-3.13.11. Be prepared! Your assessor could ask to 🔍 EXAMINE system and communications protection policy. 🗣 INTERVIEW system or network administrators. 📝 TEST cryptographic mechanisms or mechanisms supporting or implementing transmission confidentiality. (CMMC Assessment Guide: Level 2 Version 2.11, page 222) #CMMC #DoD #cybersecurity #NIST #InformationSecurity https://bit.ly/45HMpUs

41

MSPs regularly ask us if they can skip 800-171 objectives when they mention CUI. I get the logic- most MSPs shouldn't have any CUI. Here's my challenge for MSPs: Replace "CUI" with "SPD" (security protection data) and see if meeting the objective still benefits them. After all, that's the data each MSP should safeguard in their environment (and why they need a CMMC certification).

83

27 Comments

This is funny to me; many have said this for years and now NIST is aligning with it. What companies need to be focusing on is password-less methods, not trying to make a legacy password method "less-bad". Windows Hello for Business, passkey, or other phishing resistant methods are the only real way to increase your security posture. Even with a 24-character password, end users will still write that on a sticky note. 😄

9

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

I and my immediate family members will not accept a gift from: a. Anyone seeking a job with the federal government or the Transition. The Code of Ethical Conduct and federal law specifically prohibit you from receiving anything of value in return for a promise to support or use influence in obtaining an appointive office for any person. b. Anyone who seeks action by the Transition or a Trump administration. c. A federal employee in any department or agency within the scope of my Transition responsibilities. d. Any person or organization that conducts activities regulated by, or has a matter pending before, a department or agency within the scope of my Transition responsibilities. e. Any person or organization under circumstances where it may appear that the gift is being given to influence the performance or nonperformance of my duties with the Transition. I will not represent, aid, or advise a foreign government or foreign political party for the duration of my service to the Transition or for twelve months thereafter. I, _____________________________, hereby acknowledge that I have read, understand, and will abide by this Code of Ethical Conduct and further acknowledge that failure to comply with the provisions of this Code of Ethical Conduct may result in my dismissal.

2

2 Comments

At Kieri Solutions - Authorized C3PAO , we are getting questions from our clients about whether Chevron could mean that CMMC is going away. With the caveat that I'm not a lawyer... The short answer is no. The portion of CMMC that impacts defense contractors is the 𝘤𝘰𝘯𝘵𝘳𝘢𝘤𝘵 𝘤𝘭𝘢𝘶𝘴𝘦 which states essentially "𝐈𝐧 𝐫𝐞𝐭𝐮𝐫𝐧 𝐟𝐨𝐫 𝐭𝐡𝐞 𝐃𝐨𝐃 𝐩𝐚𝐲𝐢𝐧𝐠 𝐦𝐞 𝐦𝐚𝐝 𝐦𝐨𝐧𝐞𝐲, 𝐈 𝐭𝐡𝐞 𝐝𝐞𝐟𝐞𝐧𝐬𝐞 𝐜𝐨𝐧𝐭𝐫𝐚𝐜𝐭𝐨𝐫 𝐚𝐠𝐫𝐞𝐞 𝐭𝐨 𝐩𝐚𝐬𝐬 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐬𝐞𝐥𝐟-𝐚𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭𝐬 𝐚𝐧𝐝 𝐭𝐡𝐢𝐫𝐝-𝐩𝐚𝐫𝐭𝐲 𝐚𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭𝐬 𝐚𝐭 𝐋𝐞𝐯𝐞𝐥 1 / 2 / 3, 𝐢𝐧 𝐚𝐝𝐝𝐢𝐭𝐢𝐨𝐧 𝐭𝐨 𝐩𝐫𝐨𝐯𝐢𝐝𝐢𝐧𝐠 𝐭𝐡𝐞 𝐩𝐚𝐫𝐭/𝐬𝐞𝐫𝐯𝐢𝐜𝐞/𝐜𝐚𝐩𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐭𝐡𝐚𝐭 𝐢𝐬 𝐦𝐲 𝐩𝐫𝐢𝐦𝐚𝐫𝐲 𝐛𝐮𝐬𝐢𝐧𝐞𝐬𝐬 𝐟𝐮𝐧𝐜𝐭𝐢𝐨𝐧." This is a 𝐯𝐨𝐥𝐮𝐧𝐭𝐚𝐫𝐲 contract clause. It isn't being imposed upon you. The clause will be added to new, renewing, and option year contracts, almost certainly starting in early 2025. If companies want to make money selling to the DoD, they will need to accept the contract clauses. This is what the DoD CIO's office has been saying for 5 years now. At 𝘸𝘰𝘳𝘴𝘵, I think Chevron could invalidate portions of the CMMC guidance that is published separately from the CMMC Rule. Such as the DFARS Cyber FAQ, or the FedRAMP Equivalency Memo. But did you notice that the CMMC rule is hundreds of pages long, even including the full text of the CMMC Assessment Guides? That means that everything that is currently in the rule is immune, as soon as the defense contractor signs that contract clause. So again, no. #CMMC isn't going away. Unless the defense contractor decides they no longer want to make money from the Department of Defense. Please see the real lawyer's perspective below. Jacob Horne, is this how you read it too?

46

18 Comments

The final 32 CFR #CMMC rule defines Not Applicable as such: Sec 170.24 "(3) Not Applicable (N/A). A security requirement and/or objective does not apply at the time of the CMMC assessment. For example, Public-Access System Separation (SC.L2-3.13.5) might be N/A if there are no publicly accessible systems within the CMMC Assessment Scope."* I get the point the authors were attempting to make, but they should have deleted "within the CMMC Assessment Scope." Publicly accessible system components have no business existing within the CMMC Assessment Scope, and as such should be Out Of Scope assets, incapable of P/S/T #CUI. Determining whether there are publicly accessible system components WITHIN the CMMC Assessment Scope is the whole point of 3.13.5 - therefore, as worded, SC.L2-3.13.5 is absolutely APPLICABLE. The focus of 3.13.5 should have been on the existence of connections to or communications through publicly accessible system components. It appears NIST agrees. In #NIST SP 800-171 rev3, 03.13.05 has been withdrawn and incorporated into 03.13.01 Boundary Protection. So, this 32 CFR 170 definition will need to be re-written anyway. DoD lost it's example within. That's ok. They have plenty of time. What do you think? *This is also in the CMMC 2.13 Level 2 Assessment Guide, p. 10

3

In March 2024, CISA published an advisory on vulnerable smart locks from Chirp Systems. The locks use a default hardcoded password. There is even a CVE (CVE-2024-2197). This is a classical use-case of everything going wrong with #IoT products: - Hardcoded default passwords in smart locks leading to safety risks. This is unacceptable. An ultra-basic risk assessment would catch this. Because that's the sole reason for having a lock: prevent unauthorized access. - A researcher tried to report the vulnerability in... MARCH 2021. That's 3 years ago. The vendor has no VDP and obviously did not respond, even to the governmental agency. Unfortunately, there is no penalty in the US for such behavior. If you design IoT products, please implement a VDP using our guidance: cetome.com/vdp. - There is no secure update? Woops now everybody using Chirp is vulnerable because they aren't going to check CISA website or any other security-focused website. This is always a big debate, to disclose or not. - CISA is recommending network segmentation / a firewall / a VPN... This is absolutely not clear if this would mitigate this risk, because we don't know if the password is exploitable over Bluetooth or only over the Internet. If you can exploit this in Bluetooth, this is pointless and the only remediation is to disable "keyless" entry until a fix is available. My solution would be to buy something better I guess? But then we're back to square one: how do we identify "better"? We can develop cyber security labels, but would you buy the "Cyber Trust Mark" labelled product for $100 when you can find a vulnerable lock for only $70? So we're back to square two (can we say that?): regulations and enforcement. That's why we have #PSTI in 2 weeks, #RED and #CRA in Europe. Indeed, the 29th of April 2024, it will be illegal to sell such products in the UK! Note to myself: don't buy a smart lock yet.

6

4 Comments

Researchers find serious TSA SQL injection bug in small service and at first TSA responds well, but then becomes less cooperative and turns to undermining the potential seriousness of the issue. https://ian.sh/tsa

13

1 Comment

Managing #thirdparty #cyberrisk is hard. But it gets even harder when trying to manage 4th...5th...Nth tier #supplychain relationships because visibility, familiarity, and control tend to decline with each degree of removal. This chart, from a joint Cyentia Institute and RiskRecon, A Mastercard Company report, captures this challenge. Your organization (the square in the center) may be able to track breaches of your direct third parties. But what about all those others? Are you even aware that you're indirectly connected to - and thereby potentially exposed to - breaches of those Nth parties? We explore this topic in "Risk to the Nth-Party Degree." Link to download in comments.

239

35 Comments

Identity Deception in ITDR - Yes this is the old Honey Pots concepts There is another interesting concepts in ITDR called as Identity Deception, it is conceptually similar to honeypots used in networking. Both involve creating decoy elements designed to attract and engage potential attackers Honey Accounts: These are fake user accounts created within identity stores (like Active Directory) that are designed to attract attackers. When an unauthorized user attempts to access these accounts, it triggers alerts and allows security teams to respond quickly. Honeytokens: These are deceptive credential profiles placed in identity caches on endpoints. They serve as early warning signals when accessed by unauthorized users, helping to identify potential breaches before they escalate   These identities should be known to your ITDR systems though, this is not a way of checking which ITDR tool is more effective. https://lnkd.in/e7ckJxGQ #TheIdentityNavigator #iam #ITDR #IdentityAndAccessManagement

21

2 Comments

CISA Alerts on Active Exploitation of Critical Vulnerabilities in GeoServer, Linux Kernel, and Roundcube The Cybersecurity and Infrastructure Security Agency (CISA) has sounded the alarm over active exploitation of vulnerabilities in popular software products including GeoServer, the Linux kernel, and Roundcube Webmail, underscoring the urgency for organizations to apply recommended patches. ➡ GeoServer under Threat A severe vulnerability within GeoServer, identified as CVE-2022-24816 and boasting a CVSS score of 9.8, poses a significant risk due to a code injection flaw found in the Jai-Ext open source project. 👁 Attackers could exploit this vulnerability to execute remote code. GeoServer addressed the issue in version 1.2.22, released in April 2022, by removing the capability to inject malicious code. Despite the availability of technical details and proof-of-concept (PoC) exploit code since August 2022, the flaw remains a target for threat actors. ➡Linux Kernel Vulnerability Another critical concern highlighted by CISA is a use-after-free issue within the Linux kernel, tracked as CVE-2022-2586 with a CVSS score of 7.8. This vulnerability has implications for privilege escalation through the manipulation of nft tables in a way that can lead to a use-after-free scenario. Patched in early August 2022 following its demonstration at Pwn2Own Vancouver in May 2022, technical details and PoC code were published shortly after, marking it a significant risk. ➡Roundcube Webmail XSS Issue An older, yet actively exploited vulnerability found in versions of Roundcube Webmail prior to 1.4.5 and 1.3.12, has also been flagged by CISA. Dubbed CVE-2020-13965 and rated with a CVSS score of 6.1, this cross-site scripting (XSS) vulnerability can be triggered through malicious XML attachments. Roundcube issued patches for this flaw in early June 2020, with PoC code following soon after. Although the vulnerability has been known for four years, the recent CISA warning underscores its ongoing threat. ✍ As part of its directive (BOD 22-01), CISA has mandated federal agencies to address these vulnerabilities by implementing the available mitigations or by removing the compromised products from their environments by July 17. CISA emphasizes the high risk these vulnerabilities pose to federal operations, urging immediate action to thwart potential cyberattacks. #cybersecurity #cyberattack #vulnerability #cisa #cyberrisk #cyberthreat https://lnkd.in/dpW-Thne

5

Not sure if people are grasping that the statements made by DOGE, the Musk/Ramaswamy Department Of Government Efficiency, would mean they are eliminating the Department of Justice. In a chart shared by WAPO (gift link below, I subscribe), they illustrate a cut of $35.5 Billion to DOJ. The entire DOJ’s 2025 Budget request, totaling $37.7 Billion. The FBI is only $11.3 Billion of that, most of which is personnel. With a staff of 36,100, of which only 13,000 are dedicated to investigating federal crimes. Most of the manpower of the FBI is dedicated to their intelligence (6,285 FTE) and counter-intelligence (13,867) services. They are the primary intelligence agency for domestic intelligence and countering the efforts of our foreign adversaries operating in the United States. Are they seriously talking about closing the FBI? Actually that was one of Ramaswamy’s campaign pledges. In an ad from the American Exceptionalism PAC” Vivek is shown saying of the FBI “we will not just reform them, we will shut them down.” https://lnkd.in/gp6H_Z_P But that’s not all. DOJ also includes the Bureau of Prisons, with their 20,000 correctional officers. The U.S. Attorney’s program, ($2.8 Billion with 6200 attorneys) the Drug Enforcement Agency ($2.6 Billion with 3600 agents), and the U.S. Marshalls ($3.8 Billion with 3960 agents) are also part of the DOJ! #FBI #DOJ #DOGE #Musk #Ramaswamy #DEA #Russia #China #intelligence #USCourts #Attorneys

23

4 Comments

First, nobody, and I mean nobody, should mess with Brian Krebs. My favorite story about Krebs is when the Mirai botnet attacked his website. How did he respond? By figuring out who was behind it, leading to their arrest by the FBI. Second, if you are interested in computer forensics, Brian Krebs' reporting is top notch. Not only does he lay out the evidence but he explains how he obtained the evidence. So, if you want to get some insights into how forensic investigators do their best "Sherlock" impersonation, read Krebs' reports. #cybersecurity #forensics #youcanrunbutyoucanthide

6