Marty K

PSA: security tools don't need their own CMMC certification, but a fully managed service that includes ongoing support and active administration (people performing processes using the tool) does require CMMC certification. Whether you're an internal IT team member or an external service provider, your security tool vendors cannot fully absorb your CMMC burden.

47

13 Comments

Vendor Provided Containers - Part 4 The "Vendor Dependency Conundrum". So you do FedRAMP or DOD/IL* work and you have a POAM (Plan of Action and Milestones). For the folks who don't do Public Sector work, this is basically a list of all of your compliance violations and vulnerabilities. What happens when you have a vulnerability in a vendor provided container? Specifically for something the vendor doesn't produce or patch? Often companies will make this a "Vendor Dependency". A "Vendor Dependency" is basically saying, "we'll wait until the upstream vendor patches it". But lets be real for a moment. The choice to use the "Vendor Provided Container" is yours and yours alone. Making it a vendor dependency is passing the responsibility for something that is most definitely the responsibility of the Cloud Service Provider (the authorized service). I described in my previous posts how vendor provided containers are woefully inadequate for production use (not hardened, not stripped, missing FIPS, etc). Long story short, the burden is still on the Cloud Service Provider (or consumer of those containers) to do all of the above. So while vendor provided containers are good to get started, they shouldn't be anywhere near a production environment. Going forward we need vendors to move past creating "development" containers, because that's really all they're good for. We need a standard for containers coming from vendors and if vendors are truly pursuing their CISA pledge of Secure by Design, they would harden them and strip them according to best practices. If they want to make it easy for DOD/FedRAMP customers, they would STIG harden them, and provide them with valid FIPS libraries. In summary, don't use vendor provided containers. You need to build your own or work with a vendor that builds and hardens container images as a service. Building your own images has a real cost to it too. It's also a discipline to do it fast and do it well. Teams are not usually equipped to take this on and often haphazardly do this work.

19

This is to invite you to a free informational webinar designed specifically for 8(a) and SDVOSB companies interested in the upcoming Army CENTCOM CHIPS RFP. This is a $750M IDIQ opportunity with 20 awardees, offering a full range of professional services for the CENTCOM area of operations. Webinar Details: Date & Time: Thursday, August 15th, 2:00 PM EST Friday, August 16th, 11:00 AM EST Register here: https://lnkd.in/gSnmURyX   Why You Should Attend: This is an exclusive opportunity set aside for 8(a) and SDVOSB companies, with a 1-year base and 4 one-year options. The final RFP is anticipated to be released in August 2024, so now is the time to prepare!   What You Will Learn in the Webinar: Background to the CHIPS Opportunity: Understanding the CENTCOM pain points and the necessity for CHIPS. The CHIPS Opportunity Explained: A high-level overview of the Army CHIPS opportunity. The Proposal Requirements: A detailed discussion on how to prepare a winning proposal. The Source Selection Process: Insights into how the government's source selection process works. Partnering: How partnering can enhance your chances of success. Strategy Recommendations: Tips and strategies to increase your win probability. Q&A Session: Get your questions answered by industry experts.   Register now to secure your spot in the webinar and take the first step towards winning this lucrative contract. We look forward to seeing you there!

3

1 Comment