Jeff Johnson

🌟 Proud Partnership! NetCentrics is thrilled to partner with the Air National Guard to enable ANG’s cloud missions and cloud threat hunts and enhance security! Washington Air National Guard and Maryland National Guard are the first to receive these new capabilities.   Our innovative solution Wraith® seamlessly integrates with existing cloud and on-premise architectures, reducing overall costs and training duration ─ while supporting readiness and agility of Cyber Protection Teams (CPTs).    This collaboration not only strengthens ANG’s cyber defense capabilities but also sets a new standard for the Department of Defense.   Together, the ANG and NetCentrics are making strides in securing critical mission assets and workloads across multi-cloud environments.    Read the press release: https://lnkd.in/eirq3V8f #Partnership #CyberDefense #CloudSecurity #DoD #ANG

23

1 Comment

Is an ordered list reference data? That is, a list where the sequence matters – like the 1937 Order of Precedence of the British Army, specifying the sequence in which units would march on parade. I would suggest that lists are reference data and convey more information than a regular reference data table because the order matters. Even our 1937 British example has an order column, which in a true reference data table would be additional to the primary key (e.g. a code or acronym for each regiment). Order conveying business rules, as opposed to a sort order for search optimization, can be very important, e.g. “waterfall” payment sequences in finance. So this is something to bear in mind when designing reference data tables. #rdm #referencedatamanagement #mdm #datagovernance #datamanagement #metadata #datacatalog

17

6 Comments

LMI leverages considerable experience across DoD in optimizing and updating internal controls and remediating audit findings to work with organizations. In keeping with the principles of LMI’s performance optimization line of business, our teams of subject matter experts optimize key controls for consistent, compliant, and effective operations. 👉 Have a question or concern related to your organization’s property tracking processes and related internal controls? Learn more about LMI’s steps for optimizing property tracking and connect with LMI subject matter experts today: https://hubs.ly/Q02Pdfhf0 // #PeoplePoweringPossible #Defense #Audit //

11

1 Comment

Vendor Provided Containers - Part 4 The "Vendor Dependency Conundrum". So you do FedRAMP or DOD/IL* work and you have a POAM (Plan of Action and Milestones). For the folks who don't do Public Sector work, this is basically a list of all of your compliance violations and vulnerabilities. What happens when you have a vulnerability in a vendor provided container? Specifically for something the vendor doesn't produce or patch? Often companies will make this a "Vendor Dependency". A "Vendor Dependency" is basically saying, "we'll wait until the upstream vendor patches it". But lets be real for a moment. The choice to use the "Vendor Provided Container" is yours and yours alone. Making it a vendor dependency is passing the responsibility for something that is most definitely the responsibility of the Cloud Service Provider (the authorized service). I described in my previous posts how vendor provided containers are woefully inadequate for production use (not hardened, not stripped, missing FIPS, etc). Long story short, the burden is still on the Cloud Service Provider (or consumer of those containers) to do all of the above. So while vendor provided containers are good to get started, they shouldn't be anywhere near a production environment. Going forward we need vendors to move past creating "development" containers, because that's really all they're good for. We need a standard for containers coming from vendors and if vendors are truly pursuing their CISA pledge of Secure by Design, they would harden them and strip them according to best practices. If they want to make it easy for DOD/FedRAMP customers, they would STIG harden them, and provide them with valid FIPS libraries. In summary, don't use vendor provided containers. You need to build your own or work with a vendor that builds and hardens container images as a service. Building your own images has a real cost to it too. It's also a discipline to do it fast and do it well. Teams are not usually equipped to take this on and often haphazardly do this work.

19

The Department of Defense (DoD) is proposing changes to the Defense Federal Acquisition Regulation Supplement (DFARS) to implement updates from the National Defense Authorization Acts (NDAAs) for FY 2018, 2021, and 2022. These changes aim to refine requirements for contractors to submit cost or pricing data. Key updates include: 1. Higher Threshold for Certified Cost or Pricing Data: The threshold is raised to $2 million, reducing paperwork for smaller contracts while maintaining certification requirements for larger ones. 2. New Requirements for Non-Certified Data: Contracting officers can request "data other than certified cost or pricing data" to verify price reasonableness, making organized and transparent pricing documentation essential. 3. Application to Commercial Products and Services: The rules now apply to commercial items, including off-the-shelf products and services, requiring the same data submissions as traditional contracts. 4. Stronger Focus on Fair Pricing: Contracting officers have increased authority to scrutinize pricing data, even when certified data isn’t mandatory, emphasizing the need for clear, well-documented pricing justifications. The public comment period for this proposed rule ends on November 25, 2024, with comments accepted at Regulations.gov.

2

Does being compliant with CMMC really matter right now? A small fraction of defense contractors have already done the hard work to prepare for these critical requirements to protect our national defense infrastructure. For the remaining ~200,000 contractors, it is a risk management decision. Can you afford to lose contracts with those clauses? Would your business stay afloat without that government customer? Could waiting hurt your business and bottom line? We have seen companies lose HUGE contracts that resulted in having to layoff people who have been there for 20 years. This stuff has a huge impact. Don’t think that you have to do it all at once! You just need to start with a solid plan and a budget. When you do this, you are ahead of the majority and will be on your way to a competitive advantage before you know it. The hardest part is getting started. Feeling stuck? Valor Cybersecurity is here to help you get ready. #cybersecurity #defense #compliance #dod

6

Join us on Wednesday, May 29th at 8:30 AM to discover how CERT Ukraine and CISA work together to combat cyber threats! Limited tickets available - act fast! Link in bio for more details and to get tickets. #CERTUkraine #CISA #CyberDefense #Collaboration #CyberSecurity.

12

🤔 Well said Help Net Security “The tool excels in distributing software across various secure development settings, including edge and embedded systems, secure clouds, data centers, and local setups.” “Zarf simplifies deployments into a single compressed file containing everything your app needs. It can be installed without an internet connection. Its declarative approach ensures consistent application deployment every time. The tool can also incorporate legacy code into modern DevSecOps environments, facilitating deployment.” https://lnkd.in/eRwgmKwG

57

2 Comments

Are you ready for the Protech 2.0 Weather Domain? NOAA just issued a draft RFP last Friday. Take advantage of this multiple-award IDIQ contract set aside for small businesses. It has a five-year base and a five-year option period. Check it out. #Protech #NOAA #Commerce #IDIQ #bids #proposals #proposalmanagement #proposalwriting

1

You can dive deeper into the implications of this announcement and learn how to achieve 32 CFR compliance for CMMC by checking out this short video that we posted on the Kiteworks LinkedIn channel. https://lnkd.in/gPmm6wX3. #CMMC #DIB #DefenseContractors #32CFRCompliance Kiteworks

1

1 Comment

**WARNING: LONG POST** Over the past few months I've been having quite a few conversations around coalition networks or Mission Partner Environments (MPE). As you'd expect, there've been some common challenges faced across the DoD and with our partners. As you move from network centric architecture to a data centric approach, you have to first take the step toward true zero trust which is often the biggest hurdle. To move a coalition network to zero trust and to lay the ground for data centric architecture you must first address these challenges: -Develop a tetragraph based on bi-lat agreements with partners. -Tag data as releasable to different partners, groups, or roles/attributes. -Connect infrastructure, including older capabilities such as satellites, or capabilities from our partners. -Unify identity to all infrastructure for maximum traceability and control We'll sidestep the tetragraph as they are developed through mostly administrative process. The biggest challenge I've outlined is unifying identity in an environment that could have very dated infrastructure, owned by us or our partners. To solve this we have to take notes from the OG hacker world, leveraging advanced reverse shells, or reverse tunnels, to connect and authenticate to this disparately aged technology. For those that are unfamiliar, a reverse shell is a payload hackers often drop on infrastructure that initiates a connection from inside of the environment, often taking advantage of looser egress rules on the firewall, allowing the hacker to take remote control of the machine under whatever account is running the reverse shell. Reverse shells have been around for a while and can support connection to just about anything with an IP address. Taking the reverse shell concept and rolling in zero trust / unified identity solves a lot of problems. Instead of connecting directly to the reverse shell, that shell would be connected to a certificate authenticated proxy, multiplexing protocols through a single port. In this instance, the users would authenticate, be issued a TLS cert used to authenticate to the proxy and allow for complete traceability/auditability between all infrastructure and applications. These architectures can be applied at scale, with multiple certificate authorities representing each partner on network. Allowing each partner to adjust attribute mapping between environments and tighter control over who sees what and when. Aside from providing secure connectivity between partners, this architecture also lays the ground for User and Entity Behavior Analytics, ultimately enabling more dynamic or AI led monitoring and response. Completely unifying identity and audit is key to success for these deployments, the future of zero trust, and opsec/infosec. Using solutions like this would allow the DoD to consolidate its 100+ coalition networks into an easier to manage, more secure access plane for all partners.

11

Yesterday, I had the pleasure of attending #CMMCDay. There were a lot of great discussions kicked off by Matthew Travis, The Cyber AB. I took a few key points from the discussion throughout the day. 1. False Claims Act - This will continue to be the primary compliance review for the DoD. Why not 'deputize' those within the DIB to police themselves. With the payouts being received from false claims act, it appears that it will be an effective tool for the DoD. 2. Rulemaking Timeline - The DoD continues to adjudicate public comments on the #CMMC Program rule (CFR 32) and all indications are that it will be released by fall 2024. This rule will make CMMC affective and allow certifications to begin outside the Joint Surveillance Assessment (JSVA) Program. CFR 48 that will mandate CMMC be included in contracts is expected to be delayed until later in 2025. Therefore, the DoD will essentially provide a grace period from Fall 2024 to mid/late 2025 for organizations to get certified prior to mandating it in contracts. 3. Not Just Technology - CMMC is a verification and validation program. Organizations must demonstrate that they are implementing the CMMC Requirements to a third-party assessor; while some controls (e.g., encryption, malicious code scanning) can be performed using technology, other controls (e.g., background screening, training, security assessments) require people to perform. 4. 100% Ready - There was a lot of discussion on the activities within the JSVA. These assessments provide insight into what organizations can expect during a CMMC assessment. One of the key themes coming from these assessments is if you aren't 100% convinced your organization is ready for an assessment - then you’re not ready! If you couldn’t attend and want to learn more about these and other topics, send me a note. I'd be happy to share additional insights. If you were able to attend, what key points did you take away from the event?

14

Explore this GovCon Wire interview featuring insights from our CEO, Scott Aken, discussing the crucial importance of the Cybersecurity Maturity Model Certification (#CMMC) and the dynamic nature of electronic warfare (#EW) in protecting the Department of Defense (#DoD). Check out the interview for a deep dive into the importance of optimal cyber protections in today's defense environment. https://hubs.ly/Q02zV95V0 #CyberSecurity #EWDefense

22

🔐💼 Explore Scott Aken's insights on the current state of cybersecurity and innovative solutions to combat evolving threats. Learn how Axellio Inc.'s technology is revolutionizing data protection. Don't miss this Executive Spotlight interview! Read more here: https://lnkd.in/e8XSjY8z #Cybersecurity #Innovation #Axellio

10

would like to see a little bit more stick, but its a start (still a slow process) Receiving AOs have the right to refuse participating in reciprocity with another organization due to insufficient content demonstrating an informed understanding of the security posture, risk assessment of the system, and the rationale for the risk determination as defined on the RMF KS, or due to excessive risk to the enclave or site, as determined by the site AO. However, the Receiving AO must document and report this refusal to the Granting organization’s AO within 10 business days. If a refusal does occur, both organizations will continue to work, and re-work, the ATO package to reach an agreement, if at all possible. When AOs cannot reach an agreement to leverage re-use and reciprocity, both parties must use the following resolution process to gain assistance in resolving the impasse: 1. If a conflict arises, due to reciprocity refusal there should be an attempt to resolve it at the AO level. This could include, but not limited to, the Granting AO conducting new assessments. 2. If the conflict cannot be resolved at the AO level, the RMF TAG Secretariat will be notified and the RMF TAG Chair will attempt to mediate the dispute as appropriate. 3. If the RMF TAG Chair cannot reach a resolution, the issue will be taken to the AO Council, chaired by the DoD CISO, who will serve as a mediator for the dispute. 

20

Don’t miss this opportunity to join Tevora's Sr. Manager of Payments, Bill Nguyen, and Source Defense's Solution Architect, Matthew McGuirk, for an insightful webinar, "Navigating PCI DSS 4.0: Addressing New eSkimming Requirements," on Wednesday, July 24, 2024. 🕒🔒 March of 2025 is just over the horizon, and that means time is growing short to address the new eSkimming requirements in PCI DSS 4.0. This in-depth discussion will put an end to any confusion, provide guidance on roles and responsibilities, and give you an actionable roadmap for success that will help you quickly and easily address these new requirements. Register here – https://tevora.us/4c1d14m #PCI #Cybersecurity #InfoSec #SourceDefense #Tevora

19

The Defense Department is actively working on plans to build cybersecurity requirements for the defense industrial base into defense contracts as part of its Cybersecurity Maturity Model Certification https://ow.ly/EA4V50TNGPJ #DoD #cybersecurity

1

🌟 Customer Success Story: Thomas G., Chief Cybersecurity Architect @ Dynamic Animation Systems “With more stringent CUI requirements from the DoD, we had a major challenge finding simple secure file transfer solutions that also allowed us to stay compliant. Most potential solutions we researched were either too cumbersome or not practical to implement in our environment. Phalanx lets us easily exchange sensitive and CUI files without adding complexities while also providing automatic security for those files when they’re stored on our devices.” Discover more success stories and see how Phalanx MUZE can make a difference for your business at Phalanx.io #Phalanx #technology #tech #network #business #datatransfer #testimonial

6

Last week, DAF CISO Aaron Bishop and other DAF leaders attended the inaugural Air Force Technical Applications Center (AFTAC) Cybersecurity Awareness Day at Patrick SFB, Florida to discuss solving emerging cyber threats and innovative approaches to cybersecurity. “More often than not, the question is asked, ‘How do we accomplish the mission?’ when the better question should be, ‘How do we securely accomplish the mission?’” Bishop said. “We must start thinking about how we are going to change, adapt, and build upon the cyber foundation we currently employ, because to be perfectly honest, the next attack is not going to be kinetic. We must have TTPs (tactics, techniques and procedures) in place to respond to a cyber attack with resiliency and still do the job.” His keynote emphasized the importance of data protection, AI in cybersecurity, cryptography and responding to cyber attacks with resiliency. #Cybersecurity #DAFCISO #USAF #USSF https://lnkd.in/gWAYce2h

100

5 Comments