Gaurav Pal

This report should be required reading for all defenders. Nothing here is novel, but it is an exceptionally clear demonstration of how compounding organizational failures lead to full compromise by attackers. https://lnkd.in/gxHJfK4q

49

5 Comments

The transition to PQC is estimated to cost U.S. federal agencies $7.1 billion by 2035, with costs likely to increase. Sitehop demonstrated our PQC 100Gbps SAFE Series solution last year. Now that NIST has made its recommendations for PQC, we will release our solution by the end of this year. Message us to learn how you can get on the list for the first release!   #PQC #cybersecurity #future

32

1 Comment

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

#Informationsharing built on #trust and facilitated by cutting-edge #technology makes cooperative public private #partnerships a reality like the Illicit Virtual Asset Notification (IVAN) initiative. #ransomware #cyber #cybersecurity #lawenforcement #fraud #scam #aml #virtualassets #crypto #cryptocurrency #blockchain

16

What defines value? After three years of effort, this week marks the start of the federal government's enforcement of new secure software development requirements. Starting with GSA and then shifting to all commercial vendors selling to all agencies, the Office of Management and Budget industry-changing mandate is now in action. For years, vendors commented that they thought this would never happen, but guess what? It did. Attacks on nations' software are skyrocketing, and as a nation, we need to take steps to produce more secure software by design. Before implementing tools such as application security testing (SCA/SAST/DAST), you must ensure your organization has a proper foundation. This is why the NIST 800-218 Secure Software Development Framework (#SSDF) starts with organizations preparing themselves to ensure that their people, processes, and technology are prepared to perform secure software development at the organization level. CodeLock, Inc. received a grant from VIPC | Virginia Innovation Partnership Corporation to develop a dashboard to provide companies across the country with the resources they need to get started and comply with these new requirements. Over the last month, we have uploaded templates for policies and procedures that your organizations need to have in order to meet specific practice areas. Rather than you having to create this from scratch, we did the work for you, saving thousands of hours and the finances associated with that work. You can get a CodeLock account today and access all of these resources for only $19/month. Do no wait to take action, get started with the compliance process today. If you made it this far into my post, congratulations! Send me a message, and I will give you a discount code to get started for free. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT

13

1 Comment

Okta signed the Cybersecurity and Infrastructure Security Agency’s Secure by Design pledge at #RSAC to take meaningful steps in adopting #secure by design principles in the coming year. I am excited that we are accompanying our peers in the industry to take the steps needed to prioritize application security. Identity-based #attacks have become a top method for cybercriminals, and according to the Open Worldwide Application Security Project, broken access control is the number one most common web application security risk. It’s putting companies building their applications at risk. This is a priority for Okta. There’s never been a more critical time for us to come together and implement secure design principles to keep the #identity #secure. Learn more about this pledge https://bit.ly/3UQNLbz. Tomorrow is also Okta Showcase! I am excited to join Todd McKinnon, Sagnik Nandy , and others to share the latest product innovations & commitments Okta is making to secure identity. You can tune in here: https://bit.ly/4cLldaI

189

2 Comments

“Agencies, organizations and businesses that process, store or transmit CUI are now obligated to comply with NIST SP 800-171. The ripple effect is massive: It encompasses prime contractors, subcontractors and suppliers across diverse industries, including healthcare, finance, manufacturing, education and technology. The breadth of this mandate underscores the federal government's commitment to a cohesive cybersecurity posture.”

7

Have you heard, the #CMMC Program rule (32 CFR) is expected to be finalized later this year? This rule enables organizations within the Defense Industrial Base (#DIB) to start getting CMMC certifications. However, the CMMC acquisition rule (48 CRF) isn't expected to be finalized until 2025. Therefore, while certifications will be available they won't be mandatory until a later date. Additionally, DoD has already introduced a phased rollout which will give organizations an additional six months before they may be required to get a third party certification. Should you wait until CMMC is required in your contract? If you're a prime, can you run the risk of not accepting an award of a new contract or an option year of an existing contract? If you're a subcontractor, when will your prime expect you to be certified? Remember, they can't use you on their contract if you are not certified. Primes are likely to be a bigger driver for CMMC than the DoD as the program roles out. Primes run the risk of losing contracts and penalties if they don't ensure their subs are compliant with CMMC. We know that organizations preparing for CMMC Level 2 certifications typically take 6 - 18 months. Therefore, even with the phased rollout and rules not being final if you haven't started your probably falling behind. If you're not sure where to start, or if you'll need to meet these requirements reach out. It's better to ask now than to wait until you're under the gun!

65

11 Comments

Vigilocity is closely tracking this. https://lnkd.in/gGWcmUis

24

As part of our ongoing mission to bolster national security, Lionfish Cyber Security is intensifying its commitment to equip Department of Defense (DoD) ecosystems with the necessary tools and training to confront evolving cyber threats. Our initiative focuses not merely on compliance but on establishing a foundational cyber resilience that benefits all stakeholders. MSPs that work with DoD contractors will need to be Level II compliant and we can help you get there. ** HUGE Bonus- 1 company seat to help your company get compliant and 1 for your first client on the Lionfish training and GRC platform combination. We will not only train you to get certified to help others but we will make sure you have the right tools to help yourself first. MSPs will be required to get their organization certified at CMMC to support their clients beat the rush or be left behind. FREE 12 months at $2,400 value $500 coupon when you sign up before 5/20/24 - SAVEAMERICA24 Sign up today to take the Certified CMMC Professional (CCP) and Certified CMMC Assessor (CCA) Certification Training courses by LTP Lionfish Cyber Security. Classes are coming soon. Each class is only $2,999 They include 40 hours of live Zoom instruction (and a recorded review)! CCP – 6/3/24 – 6/15/24 CCA – 6/24/24 – 7/12/24 CCP – 7/22/24 – 8/3/24 CCA – 9/9/24 -9/21/24 FEATURED TRAINER Chris Haigh Certified CMMC Assessor (CCA) Certified CMMC Professional (CCP) Certified Provisional CMMC Instructor (CCI) See page for exact times. https://lnkd.in/g9b_ehnt Initiative Overview: In the realm of cyber defense, preparedness is synonymous with resilience. Recognizing the critical role Managed Service Providers (MSPs) play, we are shifting from traditional compliance training to a more comprehensive empowerment program. This initiative extends beyond CMMC to all-encompassing cyber resilience training and certification for both the CCP and CCA credentials. What We Offer: Training Programs - Adapted to the unique needs of DoD subcontractors and agencies. Our training covers essential cybersecurity frameworks and practical application, ensuring your team is not just compliant but proficient. Empowerment Through Knowledge - We believe informed teams are effective teams. Our program includes ongoing updates and support, keeping you ahead of cyber threats. Partnership and Collaboration - Join a network of MSPs and DoD entities collaborating under Lionfish’s guidance to strengthen our national cybersecurity infrastructure. Why This Matters: Your role in safeguarding the digital frontiers of DoD infrastructure is more crucial than ever. Through this program, your team will gain the expertise to not only meet compliance standards but to lead in cybersecurity initiatives, making a significant impact on our national security. https://lnkd.in/g9b_ehnt

12

My favorite new Action1 feature, CISA KEV integration, is a great way to prioritize #patching of vulnerabilities of utmost importance. This new blog post explains it in-depth.

17

3 Comments

That was fast! Especially for government timelines. After announcing 48 CFR would be available for public comments just last week, it is out for public comments. This is the rule that will require the government to put a #CMMC in contracts if the contractor will process, store, or transmit CUI. Comments are due before October 15, 2024. On first read, it is what has been expected with no surprises. Some of the highlights: - Requires CMMC Level to be identified in all solicitations (with a few exceptions) where FCI and/or CUI will be handled by the contractor - Confirmed the phased rollout previously defined in the 32 CFR proposed rule - Requires primes to confirm subcontractors, at all tiers, meet CMMC requirements - Requires contractor to meet CMMC requirements prior to contract award - Includes foreign suppliers - Defines a minimal burden, approx. 15 minutes per system, to comply with the proposed rule as the technical requirements have already been addressed by the 32 CFR proposed rule Time to dig deeper to see how it will affect DoD contracts. Did you see anything interesting in the proposed rule? https://lnkd.in/gq2TZVB9

8

1 Comment

A lot of talk regarding CMMC lately, at Island we believe that a more user-friendly way of protecting CUI is possible. Take a look at what we pulled together: https://lnkd.in/e8UjeKqE

42

Cybersecurity isn’t just a tech problem—it’s a mission-critical priority for national security. This article dives into five key areas where the next United States administration needs to step up, from protecting critical infrastructure to securing the systems in space (yes, even space!). What I found particularly insightful was the focus on public-private partnerships and staying ahead of emerging tech like AI and quantum computing. Check it out and tell me - which of these priorities do you think deserves the most attention? #cybersecurity #dataprivacy #saferwithzafer 5 Cybersecurity Priorities for The Trump Administration https://bit.ly/3OHhUq9

4

1 Comment

🎙️ Upcoming Webinar: FedRAMP for Defense Contractors 🎙️ 🚀 Join me on Thursday, December 12th at 1pm Eastern for an informational webinar about the value of FedRAMP and how that security standard affects defense contractors! 🗓️ Save the Date: Thursday, December 12th @ 1pm EST 📍 Register Here: https://lnkd.in/e9mCsUdm 🔐 What You’ll Learn: ✔️ Why FedRAMP is important to defense contractors and how it affects your business with the federal government ✔️ Why cloud service providers need to demonstrate FedRAMP Moderate or High security compliance for CMMC Level 2 & 3 certification ✔️ The latest updates on cybersecurity compliance requirements for government contractors Don't miss this opportunity to learn more about FedRAMP and how this requirement for cloud service providers can impact defense contracts! #Deltek #GovConWire #FedRAMP #Cybersecurity #DefenseContractors #Compliance #CloudSecurity #CMMC

9

2 Comments

💡 How does my PKI’s status compare to that of others? Understanding where your Public Key Infrastructure (PKI) stands compared to others can be a game-changer. It’s not just about identifying benchmarks and best practices but also uncovering areas ripe for improvement. 🌟 While it’s crucial to tailor your PKI evaluation to fit your organization’s unique needs and constraints, benchmarking against industry reports, case studies, and peer-reviewed publications can offer invaluable insights into your PKI’s performance. 📊✨ Though the PKI Consortium doesn’t publish individual maturity assessment results, we provide a vibrant community where you can exchange experiences and learn from others. Join our working groups and tap into a wealth of shared knowledge! 🤝🌐 Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium

13

Good overview of the #CMMC Program Rule Finalization and its implications. https://lnkd.in/e9acmg8U

11