Bailey Marshall

Tired of managing security testing across a scattered team? AttackIQ Mission Control centralizes control testing for faster remediation and improved ROI. 📅 Join Jose Barajas at 10 AM PT/12 PM CT/1 PM ET on July 18th to learn how AttackIQ Mission Control streamlines security operations for organizations. Discover how to seamlessly orchestrate testing across departments and locations, gain insights specific to your role with role-based dashboards, and simplify testing workflows for faster results. ➡ Register today and optimize your #SecurityOperations: https://bit.ly/3RZa5hw #LinkedInLive #Cybersecurity

13

This week I shared thoughts on the #threat of Chinese malicious cyber activity and the importance of #cybersecurity at a keynote speech to the Air Force Technical Applications Center in sunny Florida. During AFTAC's Cybersecurity Day, I encouraged DoD members and industry partners alike to go to NSA.gov to learn from some of the over 75 Cybersecurity Advisories we've published about the threat and what to do about it. We talked about threats like #VOLTTYPHOON and the tactic of #livingofftheland to access and operate in our networks. Products on NSA.gov offer ways to become a hard target by employing #zerotrust principles. We can't choose to not be targets, but we can and must choose to be HARD targets...

199

2 Comments

Security Tidbits from the desk of STAVA LLC CEO In my 32-years of Intelligence, Counterterrorism and Security experience, one of the biggest, most reoccurring mistakes I have observed is the application of generic security measures to an organization.  Contrary to popular demand, security is more than armed guards, concertina wire, closed-circuit televisions (CCTVs) and card access readers. To harden a facility against the adversary, one must truly understand the risks, vulnerabilities and threats (RVTs) associated with a facility. I have interacted with many security professionals that do not know their organization’s high-valued assets, have not walked/touched every part of their facility or holdings, and do not understand the RVTs internally/externally to their facility. Regardless of your organization’s size, a robust security program starts with a comprehensive Vulnerability/Risk Assessment. If your organization requires Security Training and Vulnerability Assessment Services, look no further, STAVA LLC is willing to assist you. Regards, Dr. Yolanda Wade, ISP®, SFPC STAVA LLC CEO https://www.stavallc.org/

12

2 Comments

"(1) Affirming Official. The Affirming Official is the senior level representative from within each Organization Seeking Assessment (OSA) who is responsible for ensuring the OSA’s compliance with the CMMC Program requirements and has the authority to affirm the OSA’s continuing compliance with the specified security requirements for their respective organizations. (2) Affirmation content. Each CMMC affirmation shall include the following information: (i) Name, title, and contact information for the Affirming Official; and (ii) Affirmation statement attesting that the OSA has implemented and will maintain implementation of all applicable CMMC security requirements to their CMMC Status for all information systems within the relevant CMMC Assessment Scope." #cmmc #dod #cybersecurity

25

Are weapons detection systems the problem or? Whenever weapons detection systems come up, it seems to stir every #security "expert" (a term I’m not particularly fond of) into action, including many who have little to no experience inside a #school. This often leads to some interesting discussions and comments. In my experience, my teams have been involved in #weapons scanning at sporting events since around 2005, when I transitioned from law enforcement to #School #Security Director. So, when the decision was made a few years ago to implement these systems across all secondary campuses, it wasn’t as big of a leap as it might have seemed. My #team knew that the success or failure of these systems hinges heavily on the people operating them and the procedures in place. Are they foolproof? Definitely not—but neither is any other aspect of school security. I've said it countless times: technology—whether it's panic buttons, cameras, weapons detection systems, access control, or anything else—is only effective if backed by solid protocols and competent personnel. So, despite what you might read on social media, these systems are working successfully across the U.S. Just because a negative article highlights a district’s failure doesn’t mean there aren’t just as many that have implemented them correctly. People are both your greatest asset and your weakest link. Stop blaming technology for a people problem simply because proper planning wasn't done. Wasn't there an acronym related to planning? Something like the 7 P's? If you know, you know! #SchoolSafety #SchoolSecurity #Communication #Assessments #NCSSD #Education #Technology #BuildingRelationships #Safety https://lnkd.in/gQeg3Stn

32

19 Comments

DISA Expands Thunderdome Zero Trust Program Deployment; Brian Hermann, Quoted. ExecutiveGov discusses the Defense Information Systems Agency's (DISA) expansion of the Thunderdome zero trust program. In 2023, the program was deployed to 15 sites and plans are underway to extend it to 60 more sites in 2024. The program involves four key components: 🔐 Customer security stacks 🔗 Software-defined wide area networking 📴 Secure access service edge capability, and 💯 Application security stacks. Brian Hermann, DISA's director of the cybersecurity and analytics directorate, emphasized the program's role in advancing zero trust architecture, which is crucial for organizational security. DISA has also finalized the contracting process to support the U.S. Coast Guard’s network security improvement efforts through Thunderdome. Versa Networks is at the forefront of enhancing cybersecurity with their pivotal role in DISA's Thunderdome project. Their cutting-edge solutions are setting new standards in securing our nation's digital infrastructure. For more details, you can read the full article here:-https://lnkd.in/gd4wAWM2 #DISA #Thunderdome #ZeroTrust #Cybersecurity #versanetworks #channelpartners

5

SixMap in The NEWS! U.S. Air Force Awards SixMap Phase I Small Business Innovation Research Contract for Continuous Threat Exposure Management https://lnkd.in/dTKiX8NF SixMap Platform to Provide Air Force Cyber Defenders Critical Advantages of Network Visibility, Risk Assessment, Threat Prioritization, and Proactive Response #CTEM, #EASM

14

The cybersecurity landscape is evolving rapidly, and a new Mirai botnet variant is raising alarms. 🛡️ The Gayfemboy botnet, rooted in Mirai, has exploited critical zero-day vulnerabilities in routers, notably CVE-2024-12856 affecting Four-Faith devices. Key facts: - Over 15,000 devices infected and daily active bots maintained. - Exploitation of known vulnerabilities (CVE-2013-3307, CVE-2014-8361) and weak Telnet credentials fuels its presence. - Targets include routers from ASUS, Kguard DVRs, and various smart home devices. - The botnet orchestrates DDoS attacks, data exfiltration, and possibly cryptocurrency mining. This botnet isn’t just a basic threat; it features advanced capabilities, deploying a modified UPX shell and proactive countermeasures against research efforts.  Act swiftly:  - Patch vulnerable routers immediately, especially those from Four-Faith and ASUS. - Monitor devices for unusual activity and implement intrusion detection systems.

3

📢 DFIR community, we need your input! We're developing a foundational threat intelligence course for new or transitioning analysts to help bridge our advanced #FOR578 course. Help us shape the future of #DFIR training by taking a few moments to complete our survey. ✍️ Fill out the survey here: https://lnkd.in/esbUWwnC #SANSTraining #ThreatIntelligence #CTI

13

This is to invite you to a free informational webinar designed specifically for 8(a) and SDVOSB companies interested in the upcoming Army CENTCOM CHIPS RFP. This is a $750M IDIQ opportunity with 20 awardees, offering a full range of professional services for the CENTCOM area of operations. Webinar Details: Date & Time: Thursday, August 15th, 2:00 PM EST Friday, August 16th, 11:00 AM EST Register here: https://lnkd.in/gSnmURyX   Why You Should Attend: This is an exclusive opportunity set aside for 8(a) and SDVOSB companies, with a 1-year base and 4 one-year options. The final RFP is anticipated to be released in August 2024, so now is the time to prepare!   What You Will Learn in the Webinar: Background to the CHIPS Opportunity: Understanding the CENTCOM pain points and the necessity for CHIPS. The CHIPS Opportunity Explained: A high-level overview of the Army CHIPS opportunity. The Proposal Requirements: A detailed discussion on how to prepare a winning proposal. The Source Selection Process: Insights into how the government's source selection process works. Partnering: How partnering can enhance your chances of success. Strategy Recommendations: Tips and strategies to increase your win probability. Q&A Session: Get your questions answered by industry experts.   Register now to secure your spot in the webinar and take the first step towards winning this lucrative contract. We look forward to seeing you there!

3

1 Comment

Free SIEM Training for Veterans: Splunk, a centralized platform for analyzing and monitoring machine data, provides real-time insights for threat detection and IT operations. Veterans can access free training and hands-on labs to build expertise in data analytics, cybersecurity, and IT operations through https://lnkd.in/gR9MpfiW. This program is a valuable opportunity to enhance your resume through self-paced learning.

3

Wireshark: Packet Operations Learn the fundamentals of packet analysis with Wireshark and how to find the needle in the haystack!

2

The Army finally released the full RFP for the long-awaited CENTCOM CHIPS opportunity, https://lnkd.in/ebTc4cFm This Army IDIQ requirement is for a full range of professional services for the CENTCOM area of operations. This opportunity is set aside specifically for 8(a) and SDVOSB companies with a 1-year base and 4x1-year options. The services required are:     · Program Management Services              · Management and Program Analysis Services     · Information Technology Services           · Operational Contract Support (OCS) Services     · Acquisition Management Services         · Data Science Services     · Vendor Threat Mitigation (VTM)            · Intelligence Services     · Financial Management Services             · Logistic Management Services     · Language Services                                     · Public Affairs Services     · Scientific Services                                      · Assessment, Monitoring, and Evaluation Services ​​​​​​ Join us in our webinar to discuss the technical aspects of preparing your submission to win the CHIPS opportunity. We will discuss the scope, the proposal requirements, source selection, partnering, and strategy recommendations. There will also be a Q&A session at the end.  Webinar Dates and Time: Tuesday, December 17th, 2:00 PM EST   or Wednesday, December 18th, 1:00 PM EST Register here: https://lnkd.in/epJJ7Nde  What You Will Learn in this Webinar: ·        Background to the CHIPS Opportunity: A short explanation of the CENTCOM pain points and the necessity for CHIPS. ·        The CHIPS Opportunity Explained: A short introduction and high-level view of the Army CHIPS opportunity. ·        The Proposal Requirements: A full discussion of the proposal requirements and how to prepare your proposal. ·        The Source Selection Process: A full discussion of how the government's source selection process works. ·        Partnering: A discussion of how partnering can enhance your chances of success. ·        Win Strategy: Insights and recommendations for each section of the proposal to bolster your p-win. ·        Q&A Session: At the end of the webinar, we will answer any questions you might have. Register now to secure your spot in the webinar and take the first step towards winning this lucrative contract. If you have any questions ahead of the webinar, feel free to reach out to us at [email protected].

3