Vicky Ames

Folks, Our confirmed attendance is at a record level. Clearly the message and mission has hit an major inflection point! Don't miss out on the secrets of CMMC compliance. The is will be both entertaining and serious, with a lot of can you believe this was happening in a organization stories. And how to solve the toughest part of your CMMC certification processes. https://lnkd.in/gcw49xQe #CMMC #CybersecurityCompliance #DoD #DefenseContracting #XDR #CyberSecurity #ThreatDetection #IncidentResponse #DataProtection #ComplianceDeadline #GovCon #DefenseIndustry #CMMCCertification #CyberReadiness #SecurityStandards #FederalContracting #RiskManagement #CyberDefense #DataVisibility

3

AC-02 is in the top 5 most important controls I'd recommend developing familiarity with 🚨 Let's continue our Neverending Story through NIST 800-53 with: AC-02 Access Control Account Management Simply stated: AC-02 governs: - Accounts and people (users, managers, roles, groups, etc.) - Access authorizations and privileges - Account management processes - Account monitoring and review - Account PII privacy ➡️ There are 12 control elements (A-L) within AC-02 🙂‍↕️ which each need to be fulfilled or inherited for overall AC-02 compliance How to simplify control implementation: - Consider how account management is conducted throughout the enterprise, application team, cloud service provider, data center, etc. - Map to Identity and Access Management tools and services - Leverage inheritance for external team services - Revisit onboarding and off-boarding processes How to automate control implementation & assessment: - Integrate configuration checks for access control mechanisms - Leverage Identity and Access Management capabilities - Configure logging and alerts for audits and monitoring - Automate account review checks ⬇️ Let me know what I missed ⬇️ #GRCEngineering #NIST #NIST80053 #Cybersecurity #ZeroTrust #GRC #AccessControl #PoliciesandProcedures #AI #AccountManagement

19

5 Comments

Come see the unveiling of the updated Cybersecurity Mesh Architecture version 3.0 today at 2pm in Maryland D! Gartner Security and Risk Management Summit 2024 #GartnerSEC #Gartner #CSMA

47

2 Comments

Is your organization struggling to understand how to approach 3.10.6, Alternate Work Sites? What is allowed and what an assessor may be looking for? In this CMMC Churns, we dive into 3.10.6, Enforce safeguarding measures for CUI at alternate work sites. In the requirement deep dive, we will look at the requirement, assessment objectives, the requirements relationships to other requirements, and evidentiary objects we would expect to see as assessors. Interestingly, there are four primary use cases (working at home; in public spaces & travelling; in a hotel room; and at a client location) that an organization can use to define its safeguarding requirements to be followed by staff when working outside of their offices. We also look at considerations your business should ponder when developing safeguarding measures. For example & remember, Alexa & Siri are not authorized listeners to CUI conversations… ================================================= Peak InfoSec Homepage: https://peakinfosec.com As the CMMC Churns Episodes: https://lnkd.in/eVGYGs3g Contact Peak InfoSec for Support: https://lnkd.in/e8sM_2Z3 Email: [email protected] ================================================= #cuicon #cmmc #cmmc2 #32cfrpart2002 #32cfrpart170 #infosec #informationsecurity #compliance #cybersecurity #cui #fci #cmmcab #thecyberab #nist800171 #defenseindustry #defensecontractors #defensecontracting #grc #manufacturing #dfars #manufacturingindustry #dib #satellite #satellitecommunications #satellitesystems #managedserviceprovider #msp #managedsecurityservices #mssp #DoD #GovCon #governmentcontracting #SmallBusiness #contracts #contractors https://lnkd.in/e28F-A86

18

2 Comments

Folks, As a CMMC Registered Practitioner supporting 100+ organizations in the DoD supply chain, I want to personally invite you to a webinar like no other. We will be discussing the CMMC final rule and how to supercharge the most challenging aspects of CMMC compliance with XDR technology. Register at the link below, to learn how to achieve 50% compliance over the most challenging aspects of CMMC compliance immediately. https://lnkd.in/gcw49xQe #CMMC #CybersecurityCompliance #DoD #DefenseContracting #XDR #CyberSecurity #ThreatDetection #IncidentResponse #DataProtection #ComplianceDeadline #GovCon #DefenseIndustry #CMMCCertification #CyberReadiness #SecurityStandards #FederalContracting #RiskManagement #CyberDefense #DataVisibility

4

Follow up on the recent NPD data breach, which exposed 𝟮.𝟳 𝙗𝙞𝙡𝙡𝙞𝙤𝙣 𝙎𝙤𝙘𝙞𝙖𝙡 𝙎𝙚𝙘𝙪𝙧𝙞𝙩𝙮 𝙉𝙪𝙢𝙗𝙚𝙧𝙨. There are several web sites that you can go to to check if you data was compromised. (check the comments for a link to one of them). 𝗥𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱𝗮𝘁𝗶𝗼𝗻𝘀 𝗼𝗻 𝗻𝗲𝘅𝘁 𝘀𝘁𝗲𝗽𝘀: • 𝗖𝗼𝗻𝘀𝗶𝗱𝗲𝗿 𝗳𝗿𝗲𝗲𝘇𝗶𝗻𝗴 𝘆𝗼𝘂𝗿 𝗰𝗿𝗲𝗱𝗶𝘁 𝗳𝗶𝗹𝗲. This will reduce the risk to an attacker making unauthorized account additions to your profile. To freeze the file, you'll want to create accounts if you haven't yet already with Transunion, Experian, and Equifax. • 𝗥𝗲𝘃𝗶𝗲𝘄 𝘆𝗼𝘂𝗿 𝗖𝗿𝗲𝗱𝗶𝘁 𝗙𝗶𝗹𝗲 𝗳𝗼𝗿 𝗱𝗶𝘀𝗰𝗿𝗲𝗽𝗮𝗻𝗰𝗶𝗲𝘀: Ensure that there is no information listed that you are not already familiar with, clean up as needed. Dispute any anomalies and remove them from the file. • 𝗥𝗲𝗴𝘂𝗹𝗮𝗿𝗹𝘆 𝗿𝗲𝘃𝗶𝗲𝘄 𝗮𝗻𝗱 𝗖𝗹𝗼𝘀𝗲𝗹𝘆 𝗺𝗼𝗻𝗶𝘁𝗼𝗿: Review any changes to your file that would be indicators of a compromise. 𝗖𝗵𝗲𝗰𝗸 𝘁𝗵𝗲 𝗰𝗼𝗺𝗺𝗲𝗻𝘁𝘀 𝗳𝗼𝗿 𝗮𝗱𝗱𝗶𝘁𝗶𝗼𝗻𝗮𝗹 𝗵𝗲𝗹𝗽𝗳𝘂𝗹 𝗹𝗶𝗻𝗸𝘀!

6

10 Comments

The Office of Management and Budget (OMB) has issued a memorandum that overhauls the Federal Risk and Authorization Management Program (FedRAMP). This new directive replaces the original 2011 memo and sets a modern vision, scope, and governance structure for FedRAMP. The changes reflect recent discussions and updates shared in FedRAMP forums. OMB’s revised strategy aims to increase the number of cloud service offerings available to federal agencies through FedRAMP. There are about 17,000 software as a service (SaaS) providers in the U.S., yet only 338 services have FedRAMP authorization. OMB intends to significantly expand this number, enabling agencies to adopt a wider range of cloud-based services. This expansion will help agencies advance operations and reduce dependence on traditional IT infrastructure. OMB stresses the importance of federal agencies adopting new cloud security methods. The updated FedRAMP framework is designed to provide agencies with secure, advanced cloud services that address emerging threats. The number of cloud service providers (CSPs) with FedRAMP authorizations has been limited due to high costs and complexities. OMB’s new memo introduces a standardized, reusable approach to security assessments, aiming to simplify the authorization process for cloud products and services. Strategic Goals: * The new FedRAMP framework is centered on risk management, tailored to modern cloud services. OMB will work with industry and federal security experts to focus on relevant threats and quickly address security weaknesses. * OMB introduces new ways to obtain FedRAMP authorization, reducing the time, cost, and complexity involved. While the memo outlines two familiar paths—agency authorization and program authorization—it also mentions that additional paths will be developed. * FedRAMP will use automation to streamline processes, employing the Open Security Controls Assessment Language (OSCAL) or a similar protocol. Automation aims to reduce the effort required to prepare and review FedRAMP deliverables, speeding up both initial authorization and ongoing monitoring. *OMB encourages CSPs to improve the security of their entire cloud offerings, not just those used by the federal government. The goal is to integrate FedRAMP security requirements into core services, avoiding the need for separate offerings tailored specifically for federal use. FedRAMP has requested public comments on its proposed performance metrics, which will measure the authorization process's security and customer experience. Feedback is due by August 29. #cybersecurity #FedRAMP

3

1 Comment

Join 3 HTi, Kevin Hyde and me tomorrow (9/27) at 12p ET as we discuss what Cybersecurity Maturity Model Certification (CMMC) means for government contractors and how your organization can be ready for it.

7

Optimize your decision-making and resource allocation by accepting and recasting risks in Tenable Security Center. 👀 Watch now! ➡️ Learn more: https://lnkd.in/ePsC_KhU #Cybersecurity #RiskManagement #Tenable

11

Great news from NIST as they adapt digital identity guidelines for state and local benefits programs. This collaboration with the Digital Benefits Network and the Center for Democracy and Technology to refine digital identity measures is a step in the right direction. It's essential to ensure that as we enhance digital services, we also safeguard privacy and equity, particularly in public benefits administration. Looking forward to seeing how these guidelines will foster more secure and inclusive digital environments. https://bit.ly/3KYuH5J

22

Many of you have questions about ISO42001, and many don't even know where to begin. It's a lot...a lot to take in, a lot to think through, a lot to consider. To help you build momentum, A-LIGN has published a new ISO42001 Frequently Ask Questions (FAQs) blog, so if you're not sure where to start on your journey, this is the place! https://lnkd.in/e3yV93kh #iso42001 #iso27001 #ethicalAI #resonsibleAI #AIGovernance #TheBusinessofCompliance #ComplianceAlignedtoYou

67

1 Comment

Outpacing Cloud Attackers with GenAI: Advanced AI Strategies for Rapid Threat Detection and Response Earn CPE credits while enhancing your knowledge on leveraging AI for cloud defense. Personally the more I hear multiple perspectives of how AI can be used in whole or in part as a defensive measure, the more I learn of the vast possibilities. I’m joining this webinar as I sense it will be quite valuable in enhancing my personal knowledge.  Register here: https://lnkd.in/g4AF36jQ #CyberSecurity #AI #CloudSecurity #ThreatDetection #Sysdig #Webinar #TechInnovation #InfoSec #CPECredits

10

3 Comments

Is your organization prepared for the new #CMMC cybersecurity requirements? Learn essential steps in achieving and maintaining compliance in the Defense Industrial Base with Carahsoft from August 27-29: https://lnkd.in/euQmFZgi

1

What does FISMA have to do with it? ➡ Many critical infrastructure sectors have interdependencies with drinking water and wastewater services. These include the Chemical, Emergency Services, Energy, Healthcare, and more. “Water, water, everywhere, and not any drop to drink” – “The Rime of the Ancient Mariner,” Samuel Taylor Coleridge 🚧 BL: No water doesn't only mean no coffee! ☕ ➡ In November 2023, the Aliquippa Municipal Water Authority in Pittsburgh experienced a cyberattack after one of its booster stations was hacked by an Iranian-backed cyber group known as ‘Cyber Av3ngers.’ Other major critical infrastructure breaches include the 2022 compromise of the Florida water treatment facility near Tampa days before the Super Bowl. ➡ Critical infrastructure is proving to be an easy target with a high margin of success. While the EPA aspires to follow in the footsteps of the Transportation Security Administration and Food and Drug Administration to provide cybersecurity rules for their sectors, Congress will need to provide the EPA with these new authorities. ➡ Immediate action is needed. The EPA and all federal regulators falling under FISMA must prioritize the security of their networks. This is crucial to ensure they can continue their operations, reducing the threat of malicious cyber actors breaching their networks. By doing so, they protect their own digital enterprise and set an example for their sectors. 💡 At Forescout Technologies Inc., We don't just SEE all IT, IoT IMoT, and OT assets on your network; we PROTECT every connected asset - managed and unmanaged. Read the full article here: https://lnkd.in/ezqUfFcC

57

11 Comments

Maximize your event ROI at the Charlotte Cybersecurity Summit! Having recently attended the San Antonio Cybersecurity Summit, I can tell you that this is worth the investment!

4

At CMMC Day I presented on preparing for a CMMC Assessment and the importance of guiding the assessment team. One of the most valuable things an OSC can do is prepare and deliver a thorough In-Brief at the beginning of the assessment. The In-Brief provides context to the assessment team so they better understand your business, your environment, the type of CUI you handle, how CUI flows through your organization, who they will interact with during the assessment, and how you manage change.  It helps the assessment team better understand your documentation, what they will be hearing during interviews, and what they will be seeing during examinations.  With apologies to Pete Townshend, the assessment team really needs to know who are you!  #CMMC #CMMCDay2024

20

1 Comment

David raises an important point about the link between disaster recovery and cybersecurity. These areas often operate in silos, but integrating them can significantly enhance organizational resilience. To achieve this, organizations must adopt a mindset of continuous improvement in both disaster recovery and cybersecurity. This involves regular drills, real-time threat monitoring, and adaptive response strategies. By doing so, we can create a more cohesive and proactive approach to both preventing and recovering from incidents. #Cybersecurity #DisasterRecovery #Resilience #ThreatMitigation

11