Cole Kennedy 🔐 🔗

🤔 Well said Help Net Security “The tool excels in distributing software across various secure development settings, including edge and embedded systems, secure clouds, data centers, and local setups.” “Zarf simplifies deployments into a single compressed file containing everything your app needs. It can be installed without an internet connection. Its declarative approach ensures consistent application deployment every time. The tool can also incorporate legacy code into modern DevSecOps environments, facilitating deployment.” https://lnkd.in/eRwgmKwG

57

2 Comments

Does being compliant with CMMC really matter right now? A small fraction of defense contractors have already done the hard work to prepare for these critical requirements to protect our national defense infrastructure. For the remaining ~200,000 contractors, it is a risk management decision. Can you afford to lose contracts with those clauses? Would your business stay afloat without that government customer? Could waiting hurt your business and bottom line? We have seen companies lose HUGE contracts that resulted in having to layoff people who have been there for 20 years. This stuff has a huge impact. Don’t think that you have to do it all at once! You just need to start with a solid plan and a budget. When you do this, you are ahead of the majority and will be on your way to a competitive advantage before you know it. The hardest part is getting started. Feeling stuck? Valor Cybersecurity is here to help you get ready. #cybersecurity #defense #compliance #dod

6

**WARNING: LONG POST** Over the past few months I've been having quite a few conversations around coalition networks or Mission Partner Environments (MPE). As you'd expect, there've been some common challenges faced across the DoD and with our partners. As you move from network centric architecture to a data centric approach, you have to first take the step toward true zero trust which is often the biggest hurdle. To move a coalition network to zero trust and to lay the ground for data centric architecture you must first address these challenges: -Develop a tetragraph based on bi-lat agreements with partners. -Tag data as releasable to different partners, groups, or roles/attributes. -Connect infrastructure, including older capabilities such as satellites, or capabilities from our partners. -Unify identity to all infrastructure for maximum traceability and control We'll sidestep the tetragraph as they are developed through mostly administrative process. The biggest challenge I've outlined is unifying identity in an environment that could have very dated infrastructure, owned by us or our partners. To solve this we have to take notes from the OG hacker world, leveraging advanced reverse shells, or reverse tunnels, to connect and authenticate to this disparately aged technology. For those that are unfamiliar, a reverse shell is a payload hackers often drop on infrastructure that initiates a connection from inside of the environment, often taking advantage of looser egress rules on the firewall, allowing the hacker to take remote control of the machine under whatever account is running the reverse shell. Reverse shells have been around for a while and can support connection to just about anything with an IP address. Taking the reverse shell concept and rolling in zero trust / unified identity solves a lot of problems. Instead of connecting directly to the reverse shell, that shell would be connected to a certificate authenticated proxy, multiplexing protocols through a single port. In this instance, the users would authenticate, be issued a TLS cert used to authenticate to the proxy and allow for complete traceability/auditability between all infrastructure and applications. These architectures can be applied at scale, with multiple certificate authorities representing each partner on network. Allowing each partner to adjust attribute mapping between environments and tighter control over who sees what and when. Aside from providing secure connectivity between partners, this architecture also lays the ground for User and Entity Behavior Analytics, ultimately enabling more dynamic or AI led monitoring and response. Completely unifying identity and audit is key to success for these deployments, the future of zero trust, and opsec/infosec. Using solutions like this would allow the DoD to consolidate its 100+ coalition networks into an easier to manage, more secure access plane for all partners.

11

Last week, I mentioned that the US Army was going to require SBOMs for both COTS and contractor software. Here are the details you need - the timeline is short, and in my opinion this is a significant memo for anyone working with the Army! This memo is tied back to EO 14028, the NIST SSDF, OMB M-23-16, OMB M-22-18, and Army Directive 2024-02. These are the same publications I've found highly valuable the past few years. What's in scope? This memo applies to any computer software developed exclusively with Government funds to include any of the following: 1. Government-off-the-Shelf software 2. Computer software developed by a Contractor using exclusively Contractor funds or Independent Research and Development funds 3. Commercial computer software (as defined by FAR 2.101) 4. Noncommercial computer software developed and delivered to the Government by a Contractor Commercial computer software includes Commercially off-the-shelf (COTS) software and open source software. It does NOT include cloud services at this time. Contract language will now require vendors to: 1. Generate and deliver SBOMs 2. Include associated license rights According to Page 2, item b, PEOs/PM's will collect, store and manage SBOMs. Then, SBOMs will be monitored and used for vulnerability, incident management, and supply chain risk management. - this is a big one for dynamic management of SBOM, and I'm thrilled to see this verbiage. Key deliverables are only 90 days out! Within 90 days (Dec 2024): - Sample SBOM language for contracts will be in place - SBOM working group will be established - Subcontractors will be notified of SBOM language - SBOM management process will be codified - Risk and incident management processes will be codified for continuous monitoring of SBOMs Starting essentially January 1, 2025: - SBOMs will be collected and analyzed for all software in use - Risk and incident management activities will be executed The 6 page memo can be found here: https://lnkd.in/gkyRTZaq Sound difficult? GitLab can definitely help - don't hesitate to reach out. #sbom #dod #usarmy #gitlab

33

13 Comments

The Department of Defense (DOD) has officially released the final rule establishing the Cybersecurity Maturity Model Certification (CMMC) Program. Effective December 16, 2024, the DoD will now require all defense contractors and subcontractors to implement and maintain specified security measures to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUl). Valiant-X understands how critical these new requirements are to your business and future growth. Contracting officers (KOs) will not be able to award new contracts, extend performance periods, or exercise options unless the company (otherwise referred to as the DIB) have a valid CMMC certification at the required level (I, II, or III). These requirements will also apply to subcontractors (SubK), current and future, ensuring that your entire supply chain is compliant from top to bottom. Book your Consultation with us now to get compliant for certification! Valiant-X Enterprise Corporation Yves Vazquez John Melcher Annette Melcher (Eichenberger), MBA, PMP Jacob Garcia Jeremy R. Thomas #cmmc #doditconsulting #cloudsolutions #dodcompliance #cybersecurity #innovativetechnology #skillsbridge #cloudarchitects #governmentcontracting #professionalservices #governmentsolutions #innovativesolutions #vxe #valiantxenterprise #cto #enterpriseit

6

Compliance doesn’t have to be chaotic. With Cyturus, DoD contractors gain a single platform where RPOs and C3PAOs collaborate seamlessly to ensure readiness, certification, and continuous compliance. ✅ #RPO? We streamline the preparation process with central dashboard, analytical capabilities, real-time SSP & POA&M, and project management tools . ✅ #C3PAO? We deliver dynamic, audit-ready documentation to simplify certification. ✅ #DoD Contractor? We unify efforts, eliminates inefficiencies, and provides confidence every step of the way. This is why The Cyber AB trust us to power the #CMMC ecosystem. It’s not just about compliance; it’s about collaboration, maturity, and long-term success. Let’s make compliance simpler, together. #Cybersecurity #InformationSecurity #NationalSecurity

15

$2.8 billion Small Business Investment Fund supported by the DoD and SBA: These two entities are working with the Small Business Investment Company Critical Technology Initiative (SBICCT), a $2.8 billion fund, which enables investors to finance small businesses creating technologies considered critical to national security. These technologies are microelectronics, space technology, software, AI and more. The original Small Business Investment Company Initiative, founded in 1958, has backed companies such as Apple, Intel, and Fairchild Semiconductor. Each investment fund that works with the initiative can borrow up to $175 million and postpone loan payments until the company becomes profitable. This is a great use of taxpayer funds because it promotes national security and competitiveness, and this program has a strong track record of investors repaying all of the loans. #SmallBusiness #SBIC #SBICCT #Investments #NationalSecurity #SBA #DoD

2

Under increasing innovation, the report recommends providing additional authorities for Software Acquisition and Middle-Tier of Acquisition, which it says should become the default acquisition method for all programs. It also endorses getting rid of the paperwork-heavy “Milestone A” designation and replacing it with a “buy-before-build” process that allows for experimentation. To increase competition, the report suggests reducing barriers to having multiple sources and streamlining the parts qualification process. It also recommends turning the services’ “program acquisition officers” into “portfolio acquisition executives,” which oversee a group of capabilities and are able to make tradeoffs among schedule, funding, and requirements. Finally, the report recommends a wholesale restructure of the budget, consolidating induvial line items for programs into ones made for an entire portfolio, and making legislative changes that would allow the Pentagon to better mitigate continuing resolutions.

11

2 Comments

DoD Contractors: FCI vs CUI We discuss CMMC Compliance requirements, implementing NIST 800-171 110 controls to meet CMMC Level 1 and prepare for CMMC Level 2 assessment.

2

1 Comment

In reviewing a topic from the latest DOD SBIR round I came across the following language right in the topic description: "The ... models developed during this project will be government-owned, and that the government will have unlimited rights to use, modify, reproduce, release, perform, display, or disclose such technical data or computer software." Asking for UNLIMITED data rights right in the topic description. For Phase I no less where you are testing the feasibility of the approach. Since inception, one of the tenets of the SBIR program is that data rights are retained by the company performing the work. Just to make sure that is still the case, I went to the latest SBIR/STTR directive dated May 2023, and yes, that is still the law. I'm used to submitting a proposal, getting the award, doing the work, and then the government being like "hey, we want your data" and I may grant them additional rights if it is beneficial to both parties. But to be so blatant as to put it right up front in the solicitation, I'm not sure how I feel about that. I guess not too good. But I guess you know what you are getting into! Does this strike anyone else as just plain wrong?

2

2 Comments

M-Day was Yesterday. We are in an undeclared national crisis. "The U.S. public are largely unaware of the dangers the United States faces or the costs (financial and otherwise) required to adequately prepare. They do not appreciate the strength of China and its partnerships or the ramifications to daily life if a conflict were to erupt. They are not anticipating disruptions to their power, water, or access to all the goods on which they rely. They have not internalized the costs of the United States losing its position as a world superpower. A bipartisan “call to arms” is urgently needed so that the United States can make the major changes and significant investments now rather than wait for the next Pearl Harbor or 9/11. The support and resolve of the American public are indispensable." From the Commission on National Defense Strategy's 2024 report: https://lnkd.in/g94zBjnK

331

16 Comments

Big changes are coming! The Army is now requiring Software Bill of Materials (SBOMs) in their acquisitions—a long-overdue move to ensure the safety and security of the software supply chain supporting critical infrastructure and systems. Make no mistake, other services are likely to follow suit. If you're facing challenges in generating or maintaining SBOMs, or if you're ready to take the next step by analyzing your software in detail—particularly the open-source packages where unseen risks may lie—Dark Sky Technology can help. Reach out to schedule an introduction to our Bulletproof Trust product and see how it can safeguard your software supply chain and meet this new requirement.

5

Congratulations to the #Navy exceeding DOD Zero Trust targets ahead of schedule, achieving unparalleled security milestones! "Flank Speed's unprecedented ability to achieve the very highest level of DoD ZT outcomes demonstrate to the Department and the federal government that ZT cyber defenses work very effectively to protect and defend our data and systems against the very latest cyberattacks from our adversaries," said Randy Resnick, Chief Zero Trust Officer for the DOD. This work sets a high bar for #ZeroTrust achievement displaying the art of the possible in achieving measurable and provable Zero Trust results in production and at scale. Having a repeatable and validated ZT solution as a baseline is a game-changer for federal security and the defense industrial base allowing other organizations to build from a predictable foundation to accelerate security objectives in the most demanding cyber environments throughout the US Government and beyond. Well done #Navy team, it has been an honor to support your vision for Zero Trust along the way learning, testing, and achieving success with Microsoft security! The best part about this approach to ZT is its repeatability so if you want to learn how to implement a similar solution to accelerate Zero Trust adoption in your department, agency, or DIB environment visit our implementation guide: https://lnkd.in/eWSE7ciK While this implementation guide is specific to Microsoft capabilities, utilizing our tooling to achieve an effective baseline for #Azure and #Microsoft365 can also extend enhanced security protection to other clouds and on-premises environments. Using our unified security platform also opens the door to an entire ecosystem of pre-integrated 3rd party security capabilities to help organizations maximize current security investments or add new ones for a strategy of layered defense. Jane Overslaugh Rathbun, Darren Turner, Justin Fanelli, Randy Resnick, David McKeown, Gurpreet Bhatia, Ian L., Andrew Masse, Wes Anderson, Candice Ling, Tyler Bryson, Ehud Itshaki, Joy Chik, Rob Lefferts, Vasu Jakkal, Richard Wakeman, Timothy Langan

87

2 Comments

Bad news for the many DoD defence industry commercial contractors requiring FedRAMP to support their CMMC 2.0 program. Luckily for you, Zafepass Prevent & Protect can fix this. Reach out to Zafehouze - making IT, OT and IoT 'Zafe' and lets have a chat about, probably the only platform providing ‘controlled protected digital environments’ - see Zafepass as a security dome - a shield you wrap around you environment. Nothing else needed. You can’t steal what is not there and as you own the ‘neighborhood’ you control your environment - as well as CUI data. More [email protected]

7

1 Comment

The DoD Chief Information Officer recently released DoD DevSecOps Fundamentals v2.5. This revision tightens up the DoD's #devsecops guidance, reducing from 16 figures to 13 figures and dropping from 47 pages down to 44 pages, while also finding space to add new highly relevant material. New sections include clarification on securing the software #supplychain with references to NIST SP 800-204D and a dedicated section on "Integrating with Other DoD Processes" that includes #cybersecurity and the #rmf, T&E, and acquisition. It also contains a number of CAC-enabled links, an entire section on workforce covering #software development roles for a smaller #cloudnative software product team, and this powerful statement (in bold) while discussing the role of a DevSecOps Platform on page 11: "Every DoD organization is encouraged to seek out an existing managed PaaS to learn about and begin applying DevSecOps." I just checked DoD CIO Library, and at the moment, only this guide has been updated. There are no changes published to the other material, such as the Tools and Activities Guide or DevSecOps Playbook, but logically those are likely in the process of being updated too. As a member of the team involved in the original publication of the expansion from a single reference document to a robust document set back in 2021, it's exciting to see these valuable guides to DoD practitioners be updated to remain both relevant and actionable. Great work to the DoD CIO team and everyone who contributed updated content and feedback from around the DoD!

188

13 Comments

🚀 Major game-changing announcement from Defense Unicorns Today!! It’s almost exactly 6 years to the day that I met 🦄 Jeff McCoy and Andrew Greene in person for the first time. I was recruiting the best software engineers I could find in the DoD to help me bring modern software best practices into satellite operations. I was literally cold-calling people chasing down names and hearing tales of amazing engineers from all across the world. I’d then try to convince them (and their bosses) to move to Colorado with me, where I was stationed at the time. I somehow managed, with no real budget, to convince about 15 people to show up. Andrew Greene and 🦄 Jeff McCoy were two of them. We spent the next 3 years working inside the Government to transform the software delivery process of not just satellite operations, but what eventually became the entire DoD. Although there were a lot of amazing accomplishments to speak of, the three of us have always known that the job wasn’t finished. That it wasn’t even close. I became passionate about fixing software delivery in the DoD when I first experienced the problem myself in operations years earlier. I had recently graduated from college, and to my surprise (and my parents) found myself responsible for a critical leg within the “this is World War 3” defense apparatus. Most of the software I was using was 10 years old. Some of it was older than I was. I felt like I was set up to fail. I did everything I could to fix it. But I didn’t know anything about how to deploy software in DoD environments. I didn’t know anything about ATOs or airgap networks. Almost everything I tried to do failed. When I think back on that assignment, I get a knot in my stomach knowing that there are young Americans still to this day, using those same systems I was using. Back to Andrew Greene 🦄 Jeff McCoy and me. We started Defense Unicorns a little over 3 years ago with this problem in mind. How to make modern software delivery easy for national security systems. We knew to be successful we needed to build something that was ✅ Secure  ✅ Compliant ✅ Airgap Native ✅ Highly Distributable  ✅ Portable ✅ Decentralized  ✅ Easy to Operate  ✅ Open Source Nothing in the world existed that was all of these things. That is, until today. It is my pleasure to introduce to you UDS. 🦄 UDS is an airgap native platform exclusively built for today’s Department of Defense, arming mission operators for modern warfare. 🦄 UDS is the future of software delivery for the Department of Defense, bringing software anywhere the mission takes you. I would love to say more, but #LikedinLimits. Comment below and we can set up some time to show you why we are so excited about UDS, and what means for you, your unit, or your company. You can also find out more at this link ——> https://hubs.li/Q02SH2PG0 #DefenseTech #SoftwareDelivery #DefenseUnicorns #DoD

179

32 Comments

🌟 TRL Levels Are BS… I'm going to get a lot of flack for this one...I HATE TRL levels when evaluating technologies for success. Here's why: We have immense technology and work done by the federal government, yet that technology sits on the shelf. When I worked for Sandia National Laboratories, I noticed the technologies were often 10-15 years ahead of industry. So What's the Problem? One big problem is that TRL levels mismatch technologies in the market for capital. When technology commercialization theories began, TRL levels were a convenient framework to start with. They show where a technology is in its stage of development up to when it's ready for production and use. The model for technology investing has many flaws, but TRL's may be the biggest dogma. Many still hold to TRL levels citing its widespread use in the military industrial complex. TRL is meant for procurement. It answers the question of: "can I use it yet?" The framework is poor for judging propensity for success: "will this technology succeed?". When I look at deeply technical hardware startups, most projects continue on too far because they have DETERMINISTIC failure modes early on but these flaws were "objection handled" away. Ironically, the more egregious, the more these flaws are overlooked or diminished. This is why some ventures can come out gunning with large early rounds ($100M+ in financing), but hit an undeniable brick wall in project financing and later stage capital as they are subjected to more sophisticated scrutiny. Ex: A: "The technology is beyond expensive." B: "But one day it won't be" A: "How?" B: "Computers used to be expensive. Now they aren't" These aren't ARGUMENTS, these are SALES TACTICS. Sales is fine, but some (entrepreneurs/investors) are accountable to their fundamentals. ❓How can this be? What is objection handling? I don't believe this is talked about much because most investors come from elite schools, which coincidentally don't teach sales. There's a difference between discussing the nuances of scaling effects (physics => manufacturing assumptions) and responding with a tagline. The result is that a lot of speculation and worse bets are built on a mountain of flawed reasoning. When scaling new technologies for highly mission critical scenarios, the military industrial complex (at least the good ones) use much more analysis (F&OR, Analysis of Alternatives, etc...). Deeply technical startup missions are extremely sophisticated, yet they've been reduced to this misused framework. I am encouraged from my network that some of these truths are becoming evident with experience; however, these ideas are generally confined to private conversation. It's not good for entrepreneurs, investors, and society to have an asset class, with immense societal implications, to function under capital markets with deeply flawed models of risk-return. If this isn't rectified Deep Tech startups are basically NFTs... #TRL #innovation #technology

9

3 Comments

🚨 Important Update for Defense Contractors and anyone related to the DIB: The DFARS 7021 clause, covering the Cybersecurity Maturity Model Certification (CMMC) requirements, has just cleared a significant hurdle. The Office of Information and Regulatory Affairs (OIRA) has completed its review, and the rule is now on its way to the Federal Register for publication. Once published, there will be a 60-day public comment period before the rule can be finalized and put into effect. Keep an eye out for the Federal Register publication—it's coming soon! We can expect 7021 to show up in contracts late Q2 next year. #Cybersecurity #CMMC #DFARS #DefenseIndustry #Compliance 

8

🚨 Important Update for Defense Contractors and anyone related to the DIB: The DFARS 7021 clause, covering the Cybersecurity Maturity Model Certification (CMMC) requirements, has just cleared a significant hurdle. The Office of Information and Regulatory Affairs (OIRA) has completed its review, and the rule is now on its way to the Federal Register for publication. Once published, there will be a 60-day public comment period before the rule can be finalized and put into effect. Keep an eye out for the Federal Register publication—it's coming soon! We can expect 7021 to show up in contracts late Q2 next year. #Cybersecurity #CMMC #DFARS #DefenseIndustry #Compliance 

9