Brett Walkenhorst

Reducing latency from 2 Seconds to the time it takes to blink. Last week Meritalk released an article on DISA's plan to roll Thunderdome out to 60 sites through FY2024.  You may ask why this is important?  Why should anyone care? This matters because Thunderdome is likely to be one of the most impactful cybersecurity programs in DoD history.  All while America’s adversaries are the most aggressive they’ve ever been.  Why does Thunderdome matter? Through Thunderdome, the DOD is significantly increasing security, lowering costs, and massively improving the user experience all at the same time.  The perfect trifecta.  Imagine being a user and waiting for web response times in excess of 2 seconds. It's 2024, Thunderdome fixes this, globally. Direct benefits: -Direct Access to the NIPRnet from anywhere in the world -Users access SaaS services directly through the service connections, bypassing the JRSS stacks -Improves existing remote access latency from 2s to <10ms -Provides full ZTNA capabilities (conditional access) and full continuous monitoring of all traffic, users, and devices -Aligns on premises ZT policies with remote users This matters and brings DoD connectivity into more modern times while increasing conditional based access and security. It's faster, less expensive, and more secure. https://lnkd.in/eDp3ykX7 #meritalk #disa #CISO #ZT #zerotrust #DoD #defensedepartment

206

7 Comments

I still predict that the FAR CUI rule will be out before Thanksgiving. Specifically I predict these 5 things: 1) The rule will require NIST SP 800-171 rev. 2 rather than rev. 3. 2) 3rd-party verification (like CMMC) will be left up to agency discretion. 3) FedRAMP moderate for CUI in the cloud (no "equivalency"). 4) No phased roll-out provision. 5) A standardized form indicating if CUI will be involved with the contract and, if so, which specific categories of CUI will included. What do you think the rule will look like?

96

38 Comments

While not new, it was interesting to read and distill the breadth of information unwittingly released by smartphone users. Please see my take of this week’s FTC report. https://lnkd.in/ekbRjEyy #privacy #security

7

2 Comments

Raj S. and Christopher Kirchhoff have done an outstanding job illustrating the challenges and successes involved in establishing the Defense Innovation Unit (DIU). While there is still much work to be done, I truly can’t imagine navigating the complexities of the Pentagon and the Department of Defense without the support of the DIU. For that, I am profoundly thankful, and I believe everyone in this country should feel the same. As the CEO of EXO Charge a pioneering tech company that has developed the fully qualified STUB battery, a solution for the longstanding issue of standardized batteries, we are currently facing a slow-moving bureaucracy. I can only imagine how much more daunting this process would be without the guidance of the DIU, under Doug Beck ‘s leadership and the C5ISR team led by Marnie Bailey This book is a must-read for anyone interested in the intersection of innovation and defense, offering valuable insights into the critical role that the DIU plays in fostering technological advancements for our national security. Whether you’re a policymaker, a tech entrepreneur, or simply a concerned citizen, the lessons within these pages are both enlightening and essential.

15

1 Comment

US Government Accountability Office calls out federal IoT cybersecurity gaps: -      Agencies missed IoT device inventory deadline. -      Persistent errors and non-compliance in cybersecurity waivers -      Risks to critical infrastructure / national security mounting Check out the full report: https://lnkd.in/e6Y3tWW9

13

The U.S. is facing a #paramedic shortage, as agencies nationwide report low #EMS recruitment and retention. In this article, we cover some of the aggravating factors to EMS recruitment and retention, and then outline how technology can help alleviate some of the problems and help first responders on the front lines. #frontline

2

White House Office of Science and Technology Policy has published guidance to federal research agencies on research security requirements stemming from NSPM-33 and the CHIPS and Science Act. It adds to existing foreign national reporting requirements new guidelines on cybersecurity, foreign travel reporting, and research security and export control training. In particular this will require universities to more tightly control their IT enterprises, but also impacts federal contractors, independent research laboratories with federal grants, and FFRDCs. These regulations have been a long time coming, but in my opinion are a positive step forward in security our nation's intellectual property and curb Chinese industrial espionage, while balancing the notion that one of America's greatest innovation strengths is our openness. https://lnkd.in/eAgDD7UW

57

1 Comment

It’s incumbent on industry to implement QRC in all solutions. See a small piece on this and what Purism, SPC is doing today! https://lnkd.in/e-Yiqz6R #PQC

8

The United States Department of Defense has issued an updated policy for deploying Internet Protocol Version 6 (IPv6) across its information systems, which took effect on December 17. Read full story: https://lnkd.in/geNg-9ZP --- #IPv6 #NetworkModernization #DOD

2

1 Comment

Cybersecurity for Smart Inverters webinar this session will focus on the final version of NIST IR 8498 Cybersecurity for Smart Inverters Webinar | NCCoE nccoe.nist.gov The National Cybersecurity Center of Excellence (NCCoE) is hosting a webinar on Cybersecurity for Smart Inverters. This session will focus on the final version of NIST IR 8498, which provides seven practical cybersecurity guidelines for small-scale solar inverter implementations. The webinar aims to share NIST’s recommendations with the community, emphasizing the importance of smart inverter manufacturers building products capable of implementing these guidelines. The event is scheduled for January 29, 2025, from 1:00 PM to 2:00 PM EST. #NIST #Cybersecurity #SmartInverter #InnovationNetwork

1

Don’t get me wrong - this is good policy. What I keep thinking about though, is how consistent are all the subordinate service policies - and cross-coupled operations policies, etc. etc. you’d think by now we’d have a Large Language Model (A.I.) cross referencing and checking all of these related policy systems for what I call “Gödelean Rot”. It’s kind of like policy as software for people, and we need a better configuration management system.

3

5 Comments

Don’t miss this opportunity to join Tevora's Sr. Manager of Payments, Bill Nguyen, and Source Defense's Solution Architect, Matthew McGuirk, for an insightful webinar, "Navigating PCI DSS 4.0: Addressing New eSkimming Requirements," on Wednesday, July 24, 2024. 🕒🔒 March of 2025 is just over the horizon, and that means time is growing short to address the new eSkimming requirements in PCI DSS 4.0. This in-depth discussion will put an end to any confusion, provide guidance on roles and responsibilities, and give you an actionable roadmap for success that will help you quickly and easily address these new requirements. Register here – https://tevora.us/4c1d14m #PCI #Cybersecurity #InfoSec #SourceDefense #Tevora

19

Dave McDonald - I agree, it's time for Gov't to "get off the pot" with employing 5G... but with caveats. I'm with Viasat Government, and across most Navy bases, we operate base-wide networks utilizing fiber, copper, ethernet, coax + managed WiFi, VoIP & TV Services. Our company also constructs/operates private 5G networks. Irrespective of technology deployed, we look at connectivity needs for DoD very pragmatically, whether at a base or the tactical edge: (1) Users don't care how they get the internet... they just want more bandwidth, seamless authentication and assurance their data is secure. (2) 5G can/should be considered for a distribution network across a base or tactical edge as can transport high capacity, doesn't need LOS, and can operate within different bands to mitigate disruption of military instruments operating in the same bands. (3) Outdoor 5G networks CAN'T [today] solve the INDOOR access problem unless there is cell amplification or hosted DAS in EVERY bldg. And still -- not all client devices support 5G. (4) No matter how 5G is used, the backhaul to a tower, bldg or vehicle needs to be secure and support the bandwidth demand. So, updated, secure and capable ISP infrastructure and capacity to a tower, base headend or tactical edge is JUST AS IMPORTANT as distributing that capacity to bldgs and edge devices.

1

‼️ In a letter to the United States Department of Defense, Senators Ron Wyden and Eric Schmitt call for an investigation into the fallout from the #SaltTyphoon #espionage ☎️ campaign. 1️⃣ There is an urgent need to protect remote OT that supports critical infrastructure, which has primarily been an afterthought in the long shadow of IT networks. 2️⃣ Interoperable encrypted systems need to be better scaled across federal agencies to ensure secure communications without sacrificing mission readiness. 3️⃣ The stakes have never been higher—let's prioritize OT resilience in the face of evolving threats. ✅ Peep the letter below and read the article here: https://lnkd.in/dvSi_Z3P Forescout Technologies Inc. Operational Technology Cybersecurity Coalition Institute for Critical Infrastructure Technology (ICIT) Technology Advancement Center (TAC) McCrary Institute for Cyber & Critical Infrastructure Security

64

2 Comments

Why did NIST add 19 new requirements in NIST SP 800-171 revision 3? Experience and judgement according to Ron Ross. The 19: 3.4.10 - System Component Inventory 3.4.11 - Information Location 3.4.12 - System and Component Configuration for High-Risk Areas 3.5.12 - Authenticator Management 3.6.4 - Incident Response Training 3.6.5 - Incident Response Plan 3.10.7 - Physical Access Control 3.10.8 - Access Control for Transmission  3.11.4 - Risk Response 3.12.5 - Information Exchange 3.14.8 - Information Management and Retention 3.15.1 - Policy and Procedures 3.15.3 - Rules of Behavior 3.16.1 - Security Engineering Principles 3.16.2 - Unsupported System Components 3.16.3 - External System Services 3.17.1 - Supply Chain Risk Management Plan 3.17.2 - Acquisition Strategies, Tools, and Methods 3.17.3 - Supply Chain Requirements and Processes

91

16 Comments

With the 60 day review period for Congress and POTUS, we should see #CMMC published in the federal register on or about Nov. 12, 2024. Then the phase-in process starts, but we have no visibility into the #DoD thought process or places for phase-in. We will most likely see a two races, the first will be for organizations that are ready (including MSSPs and MSPs), they will rush the C3PAOs, and that'll cause a log jam. Then you'll have a mad dash to MSSPs to get #DIB contractors ready as quickly as possible. Any company that hasn't planned this out is at high risk of losing DoD contracts including subcontracts.

2

Big Congrats to the states whose initial proposals have gotten the green light from NTIA! 🎉 As you start the process of pre-qualifying ISPs, TIA suggests that State Broadband offices have their sub-grantees get certified with the SCS 9001™ Cybersecurity and Supply Chain Security standard to meet BEAD NOFO requirements. This will make auditing and compliance easier since re-certification is needed every three years. Sub-grantees, TIA has created an interactive checklist based on the SCS 9001 Standard to evaluate if your plans meet C/SCRM criteria. Check out the checklist here: https://lnkd.in/dZigRKS5

3

1 Comment