Adam Clater

would like to see a little bit more stick, but its a start (still a slow process) Receiving AOs have the right to refuse participating in reciprocity with another organization due to insufficient content demonstrating an informed understanding of the security posture, risk assessment of the system, and the rationale for the risk determination as defined on the RMF KS, or due to excessive risk to the enclave or site, as determined by the site AO. However, the Receiving AO must document and report this refusal to the Granting organization’s AO within 10 business days. If a refusal does occur, both organizations will continue to work, and re-work, the ATO package to reach an agreement, if at all possible. When AOs cannot reach an agreement to leverage re-use and reciprocity, both parties must use the following resolution process to gain assistance in resolving the impasse: 1. If a conflict arises, due to reciprocity refusal there should be an attempt to resolve it at the AO level. This could include, but not limited to, the Granting AO conducting new assessments. 2. If the conflict cannot be resolved at the AO level, the RMF TAG Secretariat will be notified and the RMF TAG Chair will attempt to mediate the dispute as appropriate. 3. If the RMF TAG Chair cannot reach a resolution, the issue will be taken to the AO Council, chaired by the DoD CISO, who will serve as a mediator for the dispute. 

20

It took me a couple of years working with the DoD before I realized that there are two competing definitions of DevSecOps in wide use. In this post, I explain the two, how I think we got here, the problems we’re facing, and how can easily address fix the bug.

16

2 Comments

Reducing latency from 2 Seconds to the time it takes to blink. Last week Meritalk released an article on DISA's plan to roll Thunderdome out to 60 sites through FY2024.  You may ask why this is important?  Why should anyone care? This matters because Thunderdome is likely to be one of the most impactful cybersecurity programs in DoD history.  All while America’s adversaries are the most aggressive they’ve ever been.  Why does Thunderdome matter? Through Thunderdome, the DOD is significantly increasing security, lowering costs, and massively improving the user experience all at the same time.  The perfect trifecta.  Imagine being a user and waiting for web response times in excess of 2 seconds. It's 2024, Thunderdome fixes this, globally. Direct benefits: -Direct Access to the NIPRnet from anywhere in the world -Users access SaaS services directly through the service connections, bypassing the JRSS stacks -Improves existing remote access latency from 2s to <10ms -Provides full ZTNA capabilities (conditional access) and full continuous monitoring of all traffic, users, and devices -Aligns on premises ZT policies with remote users This matters and brings DoD connectivity into more modern times while increasing conditional based access and security. It's faster, less expensive, and more secure. https://lnkd.in/eDp3ykX7 #meritalk #disa #CISO #ZT #zerotrust #DoD #defensedepartment

206

7 Comments

**WARNING: LONG POST** Over the past few months I've been having quite a few conversations around coalition networks or Mission Partner Environments (MPE). As you'd expect, there've been some common challenges faced across the DoD and with our partners. As you move from network centric architecture to a data centric approach, you have to first take the step toward true zero trust which is often the biggest hurdle. To move a coalition network to zero trust and to lay the ground for data centric architecture you must first address these challenges: -Develop a tetragraph based on bi-lat agreements with partners. -Tag data as releasable to different partners, groups, or roles/attributes. -Connect infrastructure, including older capabilities such as satellites, or capabilities from our partners. -Unify identity to all infrastructure for maximum traceability and control We'll sidestep the tetragraph as they are developed through mostly administrative process. The biggest challenge I've outlined is unifying identity in an environment that could have very dated infrastructure, owned by us or our partners. To solve this we have to take notes from the OG hacker world, leveraging advanced reverse shells, or reverse tunnels, to connect and authenticate to this disparately aged technology. For those that are unfamiliar, a reverse shell is a payload hackers often drop on infrastructure that initiates a connection from inside of the environment, often taking advantage of looser egress rules on the firewall, allowing the hacker to take remote control of the machine under whatever account is running the reverse shell. Reverse shells have been around for a while and can support connection to just about anything with an IP address. Taking the reverse shell concept and rolling in zero trust / unified identity solves a lot of problems. Instead of connecting directly to the reverse shell, that shell would be connected to a certificate authenticated proxy, multiplexing protocols through a single port. In this instance, the users would authenticate, be issued a TLS cert used to authenticate to the proxy and allow for complete traceability/auditability between all infrastructure and applications. These architectures can be applied at scale, with multiple certificate authorities representing each partner on network. Allowing each partner to adjust attribute mapping between environments and tighter control over who sees what and when. Aside from providing secure connectivity between partners, this architecture also lays the ground for User and Entity Behavior Analytics, ultimately enabling more dynamic or AI led monitoring and response. Completely unifying identity and audit is key to success for these deployments, the future of zero trust, and opsec/infosec. Using solutions like this would allow the DoD to consolidate its 100+ coalition networks into an easier to manage, more secure access plane for all partners.

11

Congratulations to the #Navy exceeding DOD Zero Trust targets ahead of schedule, achieving unparalleled security milestones! "Flank Speed's unprecedented ability to achieve the very highest level of DoD ZT outcomes demonstrate to the Department and the federal government that ZT cyber defenses work very effectively to protect and defend our data and systems against the very latest cyberattacks from our adversaries," said Randy Resnick, Chief Zero Trust Officer for the DOD. This work sets a high bar for #ZeroTrust achievement displaying the art of the possible in achieving measurable and provable Zero Trust results in production and at scale. Having a repeatable and validated ZT solution as a baseline is a game-changer for federal security and the defense industrial base allowing other organizations to build from a predictable foundation to accelerate security objectives in the most demanding cyber environments throughout the US Government and beyond. Well done #Navy team, it has been an honor to support your vision for Zero Trust along the way learning, testing, and achieving success with Microsoft security! The best part about this approach to ZT is its repeatability so if you want to learn how to implement a similar solution to accelerate Zero Trust adoption in your department, agency, or DIB environment visit our implementation guide: https://lnkd.in/eWSE7ciK While this implementation guide is specific to Microsoft capabilities, utilizing our tooling to achieve an effective baseline for #Azure and #Microsoft365 can also extend enhanced security protection to other clouds and on-premises environments. Using our unified security platform also opens the door to an entire ecosystem of pre-integrated 3rd party security capabilities to help organizations maximize current security investments or add new ones for a strategy of layered defense. Jane Overslaugh Rathbun, Darren Turner, Justin Fanelli, Randy Resnick, David McKeown, Gurpreet Bhatia, Ian L., Andrew Masse, Wes Anderson, Candice Ling, Tyler Bryson, Ehud Itshaki, Joy Chik, Rob Lefferts, Vasu Jakkal, Richard Wakeman, Timothy Langan

87

2 Comments

Vendor Provided Containers - Part 4 The "Vendor Dependency Conundrum". So you do FedRAMP or DOD/IL* work and you have a POAM (Plan of Action and Milestones). For the folks who don't do Public Sector work, this is basically a list of all of your compliance violations and vulnerabilities. What happens when you have a vulnerability in a vendor provided container? Specifically for something the vendor doesn't produce or patch? Often companies will make this a "Vendor Dependency". A "Vendor Dependency" is basically saying, "we'll wait until the upstream vendor patches it". But lets be real for a moment. The choice to use the "Vendor Provided Container" is yours and yours alone. Making it a vendor dependency is passing the responsibility for something that is most definitely the responsibility of the Cloud Service Provider (the authorized service). I described in my previous posts how vendor provided containers are woefully inadequate for production use (not hardened, not stripped, missing FIPS, etc). Long story short, the burden is still on the Cloud Service Provider (or consumer of those containers) to do all of the above. So while vendor provided containers are good to get started, they shouldn't be anywhere near a production environment. Going forward we need vendors to move past creating "development" containers, because that's really all they're good for. We need a standard for containers coming from vendors and if vendors are truly pursuing their CISA pledge of Secure by Design, they would harden them and strip them according to best practices. If they want to make it easy for DOD/FedRAMP customers, they would STIG harden them, and provide them with valid FIPS libraries. In summary, don't use vendor provided containers. You need to build your own or work with a vendor that builds and hardens container images as a service. Building your own images has a real cost to it too. It's also a discipline to do it fast and do it well. Teams are not usually equipped to take this on and often haphazardly do this work.

19

Come see the power of purely COMMERCIAL capabilities. Don’t buy more data, tools, or shiny things to try to get to the solution. Instead obtain the OUTCOME! Ask me how at AFCEA! #ElevateISR #OutcomeAssured #SMX #TechNet2024

15

Last week, I mentioned that the US Army was going to require SBOMs for both COTS and contractor software. Here are the details you need - the timeline is short, and in my opinion this is a significant memo for anyone working with the Army! This memo is tied back to EO 14028, the NIST SSDF, OMB M-23-16, OMB M-22-18, and Army Directive 2024-02. These are the same publications I've found highly valuable the past few years. What's in scope? This memo applies to any computer software developed exclusively with Government funds to include any of the following: 1. Government-off-the-Shelf software 2. Computer software developed by a Contractor using exclusively Contractor funds or Independent Research and Development funds 3. Commercial computer software (as defined by FAR 2.101) 4. Noncommercial computer software developed and delivered to the Government by a Contractor Commercial computer software includes Commercially off-the-shelf (COTS) software and open source software. It does NOT include cloud services at this time. Contract language will now require vendors to: 1. Generate and deliver SBOMs 2. Include associated license rights According to Page 2, item b, PEOs/PM's will collect, store and manage SBOMs. Then, SBOMs will be monitored and used for vulnerability, incident management, and supply chain risk management. - this is a big one for dynamic management of SBOM, and I'm thrilled to see this verbiage. Key deliverables are only 90 days out! Within 90 days (Dec 2024): - Sample SBOM language for contracts will be in place - SBOM working group will be established - Subcontractors will be notified of SBOM language - SBOM management process will be codified - Risk and incident management processes will be codified for continuous monitoring of SBOMs Starting essentially January 1, 2025: - SBOMs will be collected and analyzed for all software in use - Risk and incident management activities will be executed The 6 page memo can be found here: https://lnkd.in/gkyRTZaq Sound difficult? GitLab can definitely help - don't hesitate to reach out. #sbom #dod #usarmy #gitlab

33

13 Comments

It has been an honor working with #USNavy and #DODCIO to achieve new milestones in cybersecurity innovation with DOD's Zero Trust approach in one of the most meaningful public/private partnerships I have seen to date. As the United States Department of Defense and Microsoft continue to push the envelope in rapid security transformation, we're leaning in further to share lessons learned along the way with the entire security community so that security companies and defenders in every organization can benefit from the combined efforts to achieve Target and Advanced Level Zero Trust. Cyber objectives are always a moving target as adversaries continually innovate, but achieving a baseline of repeatable security outcomes based on DOD Zero Trust at scale is a strong foundation for rapid iteration and innovation of collective cyber defenses. Congratulations again to Department of the Navy Chief Information Officer (DON CIO), DoD Chief Information Officer, @Microsoft Security Engineering, and Microsoft Federal Security team for having a vision for a more secure future and the follow-through to make it a reality. Jane Overslaugh Rathbun, Alvin "Tony" Plater, David McKeown, Randy Resnick, Justin Fanelli, Darren Turner, Louis Koplin, Les Call, Candice Ling, Tyler Bryson, Charlie Bell, Bret Arsenault, Timothy Langan, Ann Johnson, Wes Anderson, Leigh Madden, Richard Wakeman, Ian L., Andrew Masse #zerotrust #microsoftsecurity #government #dod #securefutureinitiative #innovation https://lnkd.in/ef_SZ53y

94

4 Comments

DoD to develop scalable genAI testing datasets Through a recently completed multi-pronged red teaming effort, the agency said it will develop repeatable testing datasets that can be used to evaluate large language model tools and services in the future. https://lnkd.in/ez-UHhFA

1

Building networks with military, civilian, and intelligence community leaders is just part of AJ’s day-to-day as the Business Development Executive for the Varonis Department of Defense team. Learn the ins-and-outs of AJ's day-to-day in this episode of Speed Data! #Cybersecurity #DataSecurity #FederalGovernment

3

Check out my talk with Jeremy Wood on his podcast. If you know me you know I can go on long tangents about data 📊 lol 😆 Grateful to share my story. #dataarchitect #dataqueen #dataanalytics #discussingdata

9

2 Comments

A good friend reached out to me last week, frustrated with his search for contract work. He's an outstanding, super-smart full-stack engineer with experience working on mission-critical projects for a Fortune 500 defense contractor. He's incredibly talented. However, contract recruiters keep focusing on his years of experience—irrelevant stuff! From my perspective, I'm not interested in someone who has been writing the same C++ or C# code for 5+ years. It often indicates they've been pigeonholed, and there may be a good reason for that! I'm MUCH more interested in specific skills and skill levels, something we are very passionate about at Skills Base. Despite significant advancements in skills assessment and management, many organizations still struggle with adopting a skills-based approach, especially in talent acquisition. This is a challenge we’re committed to solving.

20

2 Comments