Don Maclean

Cybersecurity Maturity Model Certification (CMMC) 2.0 is here. If your company is not prepared, the time to get ready is now, or your company may risk losing business with the Department of Defense (DoD). The CMMC program requires cyber protection standards for companies in the Defense Industrial Base (DIB) and aims to protect sensitive unclassified information that the DoD shares with contractors and subcontractors.

Implementing zero trust may seem daunting, but it is also an opportunity to integrate more secure coding practices into your software applications from the start. Zero-trust security assumes that all traffic on your internal network is potentially malicious. Consequently, it requires taking measures to:

In view of current events, the Cybersecurity Infrastructure Security Agency (CISA) has noted the increased likelihood of a cybersecurity breach. Their recommendations, listed below, speak mainly to the basics of cybersecurity:  foundational practices and technology that protect every enterprise, in both the public and private sector. Below are the key elements (full details are here Shields Up | CISA):

In a Department of Defense (DoD) Town Hall held on February 10, led by David McKeown, DoD’s Senior Information Security Officer and Deputy CISO, we heard some news about CMMC. Defense contractors holding Controlled Unclassified Information (CUI) will need a third-party assessment to obtain certification.

Are you next? Will criminals target your organization with ransomware? No one can say for sure, so prepare now. Here are four and a half critical decisions to make – and things to do – before a crisis hits.   (What’s half a decision, you ask? What’s half an action, you may wonder. Read to end if you want to find out). 1. Do: Have a plan This sounds so obvious, but I have seen major organizations in business and government scrambling to respond to a ransomware attack. Your plan should include at least these elements?

President Biden has recently issued the “Executive Order on Improving the Nation’s Cybersecurity”, which requires government agencies to present plans for implementing a Zero Trust architecture, imposes stringent standards for threat sharing on government contractors and agencies alike, requires software vendors to show a Software Bill of Materials to demonstrate the security of their products, and seeks broad modernization of the Federal government’s cybersecurity posture.

Hackers recently attacked computer systems belonging to the Colonial Pipeline company, forcing them to shut down operations and inhibiting delivery of diesel fuel, gasoline, and jet fuel throughout the East Coast of the United States. The company has responded quickly but cautiously and expects to resume normal operation very soon. In the meantime, a declaration of emergency from the White House allows extended operation of other means of petroleum transport.

The Technology Modernization Fund (TMF) recently received a much-needed influx of funds, bringing its total to $1 billion.  This money is a small part of the funding for technology upgrades in the government, and a very small part of the overall COVID relief bill of which it was a component. The bill does not indicate how the money is to be spent but for most observers modernization is almost equivalent to cloud adoption, with cybersecurity a close second. While most observers accept that the U.S.

If your business sells products or provides services to the Department of Defense (DoD), then you should know about the Cybersecurity Maturity Model Certification (CMMC) program. 

DoD has recently incorporated CMMC requirements into the Defense Federal Acquisition Regulation Supplement (DFARS Case 2019–D041, available here https://bit.ly/30LXAeE).  The rule change is currently open for public comment, and I urge all interested parties to read it and provide input.  

DLT Solutions recently sat down for an interview with Joyce Hunter, executive director for strategy and process at the Institute for Critical Infrastructure and Technology (ICIT), the nation’s leading cybersecurity think tank. On the table for discussion was how ICIT is cultivating a “cybersecurity renaissance” – including promoting the role of women in cybersecurity. We also talked to Hunter about how government agencies can compete more effectively for cybersecurity talent and nurture the next generation of cyber warriors. 

The old saying goes, there are only two kinds of organizations: those that have been breached and those that will be soon. Clearly, the “moat-and-castle” approach to security has not worked. Simply being “inside” a network – behind a firewall, DMZ and other traditional defenses – does not confer trustworthiness, whether it’s a device, a user, network traffic, or an application.

DHS recently published version 3.0 of the Trusted Internet Connection (TIC) architecture. A response to changing IT conditions, Executive Orders, and OMB mandates, the new architecture seeks to support IT modernization through cloud adoption while keeping security as a top priority. The comprehensive set of documents includes an overview, a catalog of security capabilities, a reference architecture, guidance for pilot programs, advice for service providers, and a very helpful set of use cases relevant to agency needs.

The Threat Risk is a function of likelihood times impact.  When it comes to zero-day exploits, particularly those that use return-oriented programming (ROP) or one of its many cousins the likelihood is high, and the impact is higher.  How do these attacks work, and what is the industry doing to stop them?  More importantly, what can you do to stop them?  Is it possible to stop a zero-day without patching or updating systems?  Let’s explore these questions. How ROP Works

The Cyberspace Solarium Commission recently released a groundbreaking report detailing 75 recommendations for improving the cybersecurity of the nation, including both the private and public sectors. The Commission, bipartisan in both name and spirit, conducted over 300 meetings with industry, academia, U.S. government, think tanks and foreign governments. I had the privilege of participating in this effort. The result is a comprehensive report that urges immediate and concrete action on its recommendations, organized into six pillars”:

Last week, my associate, Shane Rogers, shared an article on GovCybersecurityHub discussing the Cybersecurity Maturity Model Certification (CMMC) and its potential impact on small- and medium-sized government contractors.

I recently had the opportunity to visit an amazing new facility—the Cyber Range at Tech Data—and got to meet the truly exceptional people who make it happen. The facility has many purposes, stemming from the powerful sense of mission that drives the staff.

At RSA this year, Chris Krebs gave an important talk: “Cybersecurity Has a Posse” where he stressed the importance of collaboration between government and industry to fight the cybersecurity war. He started by pointing out that his agency, Cybersecurity and Infrastructure Security Agency (CISA) is an “all-source” group. He meant that CISA collects threat information from sources all over the world, including government agencies, private industry, and more. Krebs’ group consolidates that information and disseminates it – daily – to security professionals across all industries.

The security of public sector networks is under attack. Each day security and IT professionals work hard to defend the integrity of mission-critical data and systems against increasingly frequent and complex cyberattacks. Staying informed is critical to staying ahead. That’s great, but there are literally dozens of cyber news outlets, journals, and bloggers to follow. Security leaders and practitioners don’t have time to filter what’s urgent and relevant to their organizations. That’s why we’ve created GovCybersecurityHub.

The first half of 2019 continued to be a busy one for cybersecurity teams and their organizations. But the nature of the adversary is changing. New insight from DLT partner, CrowdStrike, finds that attackers are “continuing to ramp up in both their brazen behavior and sophisticated means.”

The DoD Cybersecurity Strategy https://www.fifthdomain.com/dod/2018/09/19/department-of-defense-unveils-new-cyber-strategy/ stresses nine key points. With the end of FFYE looming, are you aligning your spending with these objectives?

Many government agencies, particularly large agencies, face enormous obstacles in simply compiling and inventory of the software and hardware under in their system. The difficulty is understandable: I know of one agency responsible for 220,000 makes and models of medical devices (note that this number refers to “makes and models” only. The actual number of devices is much, much higher). In addition, the devices are online intermittently, and many of them are on air-gapped (i.e., physically separate networks), complicating the use of automated tools for identification and inventory.

Every government organization has been the victim of a cybersecurity incident. These can range from mundane incidents such as a user leaving their desk without locking their screen, up to a major breach such as the OPM hack in which hackers stole comprehensive and confidential information on millions of government employees and contractors.

Identity and Access Management (IAM) is the art and science of ensuring that someone is who they say claim to be. This ensures that they have the correct level of access to systems and data – enough to do their job, but no more. IAM systems cover a wide range of features, but typically include:

Cybersecurity assessment initiatives and frameworks abound in the US government, the most important being the Federal Information Systems Management Act (FISMA), passed in 2002.  The law’s broad scope included a mandate to the US National Institute of Standards and Technology (NIST), charging it to create methods and standards to assess and optimize the cybersecurity posture of US government agencies.

“Hope for the best, plan for the worst”. This ancient principle still applies, especially for systems with high availability requirements. Principles are easy to quote, but how does an organization implement them effectively?

The “Internet of Things”, or IOT: we’ve all heard the term, but what does it really mean? More importantly, how do we secure all of these … “things”?

Cell phones, tablets, wearables, and other mobile devices dominate our lives. I personally bring my trusty iPad to everywhere, and, like everyone else, have my phone with me at all times. The biggest attack surface for any enterprise, then, may well be these devices. How can we assess the threats? What are the components in need of protection? What are some key methods of protecting them?

Earlier this month, I wrote about the Zero Trust model for security. As I proceed through these daily blogs, I find many of them complement the ZT model; data security is one. Outside the IOT world, the goal of cybersecurity is to protect data. The Zero Trust model recognizes this and focuses on keeping security close to the asset, and portable.

Configuration management is a many-headed beast, but the biggest beast with the sharpest teeth is the patch monster.  Every day, a new vulnerability, a new patch – and an old decision:  patch and maybe break something (I’m looking at you, Spectre and Meltdown), or stay online and be vulnerable.  This model – “panic patching” -- is in wide practice, but not sustainable.  For now, an efficient and reliable system is essential; for the long term, we need an entirely new model.

By now, you’ve heard it a hundred times: the perimeter is breaking down, no more “crunchy outside” to protect a “chewy inside”, no more castle-and-moat model of network infrastructure security. If there is no inside and outside, then where do defenses belong? What security architectures make sense for such amorphous network?

Once upon a time, endpoint security was just a hall monitor: it watched for known bad files identified with a simple signature and sent you an alert when the file was blocked. To be safe, it would scan every machine daily, an intrusive activity that slowed down machines, and sped up the heart rates of affected users and hapless analysts at help desks.

Insider Threat: it’s one of the biggest and most persistent issues in cybersecurity. High-profile cases – Manning, Snowden, and others – have kept the issue in the public eye; government security personnel are rightfully concerned. In addition to the willfully malicious, though, many insiders lack ill intent, but pose a threat just the same.

Do developers at your company keep application security top of mind when coding? Do they have training in secure code development?  Do they have the tools to develop code securely? If they find a security issue, can they quickly fix the issue in all instances throughout a large-scale application? If they use open-source code, do they verify its security?

“Build it in, don’t bolt it on” is a mantra we all learn when we study cybersecurity, yet we see it in practice far too rarely. Our adversaries also know this principle and have begun to implement it by infecting the supply chain – hardware and software – as close to the source as possible. DLT technology partners Crowdstrike and Symantec both note the trend in recent threat reports. In their July,2018 report1, Crowdstrike notes that:

Phishing, vishing, whaling, spear-phishing: the list of clever new terms seems constantly to change. A successful attack by any other name, though, is just as sweet to the adversary. Terminology aside, the fundamental problem is this. Phishing is the most common and effective way to steal data because it goes after the weakest chain in our cybersecurity armor: the human being. Even high-profile people, including one CEO of a major cybersecurity firm and major figures in law enforcement, have fallen victim to phishing attacks.

“Trust but verify”:  a Russian proverb Ronald Reagan often used to characterize U.S.-Russia relations, especially regarding nuclear weapons. The Internet has made it clear that the “trust” part of the proverb may not work so well. Today, we may have to say “Never trust; only verify”.

Every security professional knows that the adversary has the advantage. Security professionals have to find every vulnerability (good luck with that) and remediate it, and the enemy only needs to find one vulnerability and exploit it. This asymmetry underlies their economic advantage: finding one vulnerability gives access to a huge number of systems. In addition, for those willing to forego their conscience and risk jail, it is possible to make large sums of money in a short time, even with a minimum of technical expertise.

You have heard it enough to make you aim a fire extinguisher at your firewall:  “compliance does not mean security”. Compliance work can consume up to 70% of security budgets in Federal government agencies, and it is common to spend more money identifying, documenting, and gaining approval for a remediation than the remediation itself costs.

Return on investment: is it worth the money? That is the central question in both government and industry when deciding on any procurement. Demonstrating ROI on cybersecurity products is notoriously difficult, and is one of the underlying reasons for the poor state of our nation’s cybersecurity posture.

On January 22, the Department of Homeland Security (DHS) issued a directive to government agencies in response to breaches of the Domain Name System (DNS). The attackers used stolen credentials to alter DNS entries and steal certificates used for encryption and decryption.

The “National Cyber Strategy”, released recently by the White House, offers a broad blueprint for America’s approach to cybersecurity.  Let’s look its four “pillars”, and their key elements.

“Cyber Hygiene”:  you know the term, but what does it really mean? Some say it is an ill-defined set of practices for individuals to follow (or ignore). Others say it is a measure of an organization’s overall commitment to security.  Still, others think of “cyber hygiene” as simple, readily available technologies and practices for cybersecurity.

This month, Symantec caught up with Don Maclean, Chief Cyber Security Technologist, DLT, to get his thoughts on today’s top cyber challenges. You can hear more from Don at the Symantec Government Symposium on Oct. 30, as he shares his perspective on the “Aligning Cyber Priorities and Modernization Policies” panel.

To improve the federal government’s cybersecurity posture, the Department of Homeland Security created the Continuous Diagnostics and Mitigation (CDM) program.  On September 6, the House of Representatives voted to codify CDM, and barely two weeks later, the White House’s National Cyber Strategy assigned to DHS still more authority over cybersecurity in the United States.  What’s more, government contractors are winning 9- and 10-figure CDM contracts, so it’s clear that CDM’s time has come.

As hackers get more sophisticated, endpoint protection (EP) systems have grown more sophisticated. While no one claims to catch everything, endpoint protection matures each year. Let’s see what modern EP products have to do these days.

From Equifax to Yahoo, WannaCry and Petra, every month seems to bring with it yet another high-profile attack. Vendors roll out patches and fixes, and questions are asked across the political and security communities.

There’s a lot of buzz about blockchain these days, even in government. In fact, we predict that 2018 will be the year of blockchain in government. Blockchain’s inherent security makes it resistant to data manipulation, making it a great tool for securely recording transactions between two parties, everything from medical records, contracts, transactions, even online voting.

Defending against insider threats is a top priority for the U.S. government. When surveyed by MeriTalk, 85% of federal cybersecurity professionals say their agency is more focused on combating insider threats in 2017 than they were just a year ago.

Containers offer many advantages for management, deployment, and efficient development of applications.  Like any technology, however, they are subject to attack from malicious actors, and require diligent security.  Vulnerabilities can appear in the container images themselves, in the registry where they are stored, or in the orchestration and deployment of the images.  Let’s take a look. Image Vulnerabilities & Countermeasures