Merline Saintil

Does being compliant with CMMC really matter right now? A small fraction of defense contractors have already done the hard work to prepare for these critical requirements to protect our national defense infrastructure. For the remaining ~200,000 contractors, it is a risk management decision. Can you afford to lose contracts with those clauses? Would your business stay afloat without that government customer? Could waiting hurt your business and bottom line? We have seen companies lose HUGE contracts that resulted in having to layoff people who have been there for 20 years. This stuff has a huge impact. Don’t think that you have to do it all at once! You just need to start with a solid plan and a budget. When you do this, you are ahead of the majority and will be on your way to a competitive advantage before you know it. The hardest part is getting started. Feeling stuck? Valor Cybersecurity is here to help you get ready. #cybersecurity #defense #compliance #dod

6

Looking forward to this talk. #HPC, #AI, or any other sensitive workloads are not truly confidential without securing them AND verifying the integrity of that security. Both AMD and Invary are critical components of this, showcased through the NSA's maat project. Join us and use the code SPEAKER15 to get 15% off your pass. #CCSummit

11

What defines value? After three years of effort, this week marks the start of the federal government's enforcement of new secure software development requirements. Starting with GSA and then shifting to all commercial vendors selling to all agencies, the Office of Management and Budget industry-changing mandate is now in action. For years, vendors commented that they thought this would never happen, but guess what? It did. Attacks on nations' software are skyrocketing, and as a nation, we need to take steps to produce more secure software by design. Before implementing tools such as application security testing (SCA/SAST/DAST), you must ensure your organization has a proper foundation. This is why the NIST 800-218 Secure Software Development Framework (#SSDF) starts with organizations preparing themselves to ensure that their people, processes, and technology are prepared to perform secure software development at the organization level. CodeLock, Inc. received a grant from VIPC | Virginia Innovation Partnership Corporation to develop a dashboard to provide companies across the country with the resources they need to get started and comply with these new requirements. Over the last month, we have uploaded templates for policies and procedures that your organizations need to have in order to meet specific practice areas. Rather than you having to create this from scratch, we did the work for you, saving thousands of hours and the finances associated with that work. You can get a CodeLock account today and access all of these resources for only $19/month. Do no wait to take action, get started with the compliance process today. If you made it this far into my post, congratulations! Send me a message, and I will give you a discount code to get started for free. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT

13

1 Comment

Today, Anduril and Palantir Technologies are announcing a partnership to accelerate the adoption of AI for national security. Together, we’re addressing two core challenges that limit the potential of AI in defense: 1. Data Readiness: Most tactical-edge data—collected by sensors, vehicles, and autonomous systems—is lost before it can be used. This is a missed opportunity to train AI models on real-world conditions. With Anduril’s Lattice and Menace systems, we’re capturing and securing that data at the edge, creating a pipeline for AI training and inferencing that transforms operational realities. 2. Enterprise-Scale AI Deployment: Even when data is retained, the infrastructure to process, train, and deploy AI models securely and at scale doesn’t exist. That’s where Palantir’s AI Platform (AIP) comes in. AIP provides a secure, scalable environment for AI development, meeting the unique demands of classified and unclassified operations. Together, these systems unlock the full potential of defense data—turning it into actionable intelligence and next-gen capabilities. This partnership also enables collaboration with leading AI developers, including OpenAI. By connecting the tactical edge, secure cloud infrastructure, and cutting-edge AI models, we’re building the complete solution for operationalizing AI. But this is bigger than just two companies. National security AI requires a consortium of innovative partners to ensure the U.S. stays at the forefront of advanced technology. That’s the vision we’re building, starting today. Learn more about how Anduril and Palantir Technologies are shaping the future of AI for defense: https://lnkd.in/dh3GjCrh

5,591

108 Comments

This announcement highlights a growing need for talent with expertise in AI, data science, and cybersecurity within the defense industry. Let's break down the implications: 1. Increased Demand for AI/ML Talent: * Data Scientists and AI/ML Engineers: Anduril and Palantir's partnership emphasizes using AI to analyze tactical data. This means a surge in demand for data scientists, AI/ML engineers, and related roles. These professionals will be needed to: * Develop and train AI models on the data collected by Anduril's systems. * Optimize these models for deployment within Palantir's AIP platform. * Analyze the output of these models to generate actionable intelligence. * AI Ethicists and Explainability Experts: As AI plays a larger role in defense, ensuring responsible and ethical AI development becomes crucial. This may involve hiring experts who can: * Evaluate AI systems for bias and fairness. * Develop methods for explaining AI decisions, especially in critical military contexts. 2. Data Engineering and Cybersecurity Expertise: * Data Engineers: With Anduril's focus on capturing and securing data at the edge, the need for skilled data engineers will increase. They will be responsible for: * Building and maintaining the data pipelines that feed AI systems. * Ensuring data quality and integrity. * Managing and securing vast amounts of tactical data. * Cybersecurity Professionals: Given the sensitive nature of defense data, cybersecurity becomes paramount. This will require: * Experts in securing AI systems and data pipelines from cyberattacks. * Professionals who can develop and implement robust cybersecurity protocols. 3. Advanced Manufacturing and Systems Integration: * Software Developers and Systems Engineers: The integration of AI models into defense systems will require skilled software developers and systems engineers who can: * Build the software infrastructure to support AI applications. * Integrate AI models with existing defense systems. * Ensure the reliable and secure operation of these integrated systems. Overall Implications: * Upskilling and Reskilling: The defense industry will need to invest in upskilling and reskilling existing employees to meet these new talent needs. * Partnerships with Academia: Collaboration with universities and research institutions will be vital to attract and train the next generation of AI and data science talent. * Competitive Compensation and Benefits: To attract top talent in a competitive market, the defense industry will need to offer attractive compensation and benefits packages. This partnership signals a significant shift towards AI-driven solutions in defense, needed to maintain our technological edge and ensure national security. Hyena Enterprises Global (H•E•G) is dedicated to training the advanced manufacturing talent needed to support the future of the defense industrial base.

4

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive 25-01, mandating federal civilian agencies to enhance cloud security by 2025. This directive requires agencies to identify all cloud tenants by February 21, 2025, deploy CISA's automated configuration assessment tools by April 25, 2025, and implement Secure Cloud Business Applications (SCuBA) policies by June 20, 2025. These measures aim to mitigate risks from misconfigurations and weak security controls, reducing the federal government's attack surface. CISA also recommends that all organizations adopt these practices to bolster cybersecurity resilience. #ZeroTrustAdvocate

2

A colleague sent me a link to Bob Lord's Thanksgiving "I'm thankful for TLS" post, The Quiet HTTPS Revolution https://lnkd.in/gCx2uxdU Good article, and TLS is doing a ton of work for all of us. Lest we forget about the pitfalls of metadata, however, if you're trying to achieve reasonable (not over-the-top) security, other fundamentals like the DNS exhaust from browsing should be protected, as well. Otherwise, someone that would have been in position to view the unencrypted trafffic can still make accurate guesses on what you are up to. Also, let's not forget to give a heartfelt thanks to the Electronic Frontier Foundation (EFF) for creating Let's Encrypt and Certbot, without which, millions of sites would still be without trusted certificates.

13

Big update in #defense; FOCI mitigations and approvals through the Defense Counterintelligence and Security Agency (DCSA) are required for companies with contract awards $5M or more, even if all the work is UNCLASSIFIED. This article highlights the substantive changes in how the government is protecting the DIB from undue foreign influence. It also demonstrates that a lot of the details are yet to be ironed out. Here’s the main piece of advice: “DoD contractors that do not currently hold a facility clearance but do have DoD contracts in excess of $5 million should familiarize themselves with the SF-328 and establish policies and procedures to assess and comply with the FOCI Instruction and forthcoming DFARS provision.” The main issue I see is Defense Counterintelligence and Security Agency (DCSA) becoming THE BOTTLENECK for contract execution, and now not just for classified contracts, but ALL CONTRACTS OVER $5M. (Calling AI solutions to speed up FOCI approvals and Security clearance processing!). I’m curious if folks have already been affected by this- delayed contract start dates, any new terms you’re seeing?! Please share! #nationaldefense #executionmatters #onward

28

2 Comments

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

Is AI a friend or a foe? "There’s no guaranteed path to safety as #ArtificialIntelligence advances" warns Geoffrey Hinton, a pioneer in AI. In a recent interview with Scott Pelley, Geoffrey shares his thoughts on both the benefits and dangers of AI. What's your take? Watch 60 MINUTES: https://lnkd.in/gxJc3YkJ #AI #GenerativeAI To gain weekly insights on #technology and #innovation, subscribe to #CXOSpice newsletter (https://lnkd.in/gy2RJ9xg) and tune in for the latest edition on “Cyber Insurance”. Or subscribe to #CXOSpice YouTube channel (https://lnkd.in/gnMc-Vpj) and tune in for the upcoming episode featuring Vivek Mohindra at Dell Technologies on “AI Open Ecosystem”

303

64 Comments

I highly recommend First Breakfast - insightful analysis of topics critically important to our future. Shyam Sankar Nadia Schadlow I would add one topic to this analysis and that's DATA. So much of what we must build and deploy relies on data and we live with a data management model that hasn't changed in over 20 years - centralized mass storage of dumb data. This model is critically inefficient and we suffer from a chronic lack of data security and dat integrity. Furthermore, we struggle with interoperability of data and an inability to acquire the "right data, at the right time and in the right format", a problem exacerbated by technical debt that costs us $trillions / year (Accenture). A radically new data management approach is needed, one that stores, manages and secures intelligent data where it is needed across the millions, if not billions, of devices. Intelligent data knows everything about itself including its provenance, lineage and chain of custody, is directly findable and is stored in a manner that makes it accessible by all authorized and trusted systems. Security, control, interoperability and rights enforcement are pushed into the data management system itself, eliminating the need for much of the infrastructure (ETL, MDM etc.). In summary, we must address the critical data issues and inefficiencies to take full advantage of the re-industrialization that I agree is sorely needed. Brian "Maddog" Maddocks

3

Okta signed the Cybersecurity and Infrastructure Security Agency’s Secure by Design pledge at #RSAC to take meaningful steps in adopting #secure by design principles in the coming year. I am excited that we are accompanying our peers in the industry to take the steps needed to prioritize application security. Identity-based #attacks have become a top method for cybercriminals, and according to the Open Worldwide Application Security Project, broken access control is the number one most common web application security risk. It’s putting companies building their applications at risk. This is a priority for Okta. There’s never been a more critical time for us to come together and implement secure design principles to keep the #identity #secure. Learn more about this pledge https://bit.ly/3UQNLbz. Tomorrow is also Okta Showcase! I am excited to join Todd McKinnon, Sagnik Nandy , and others to share the latest product innovations & commitments Okta is making to secure identity. You can tune in here: https://bit.ly/4cLldaI

189

2 Comments

Join us on Wednesday, May 29th at 8:30 AM to discover how CERT Ukraine and CISA work together to combat cyber threats! Limited tickets available - act fast! Link in bio for more details and to get tickets. #CERTUkraine #CISA #CyberDefense #Collaboration #CyberSecurity.

12

Once NIST SP 800-171 and SP 800-171A are published this month, federal agencies are on the clock to start using Revision 3 (outlined in the Office of Management and Budget (OMB) Circular No. A-130, “Managing Information as a Strategic Resource.” The policy states on page I-16: “For legacy information systems, agencies are expected to meet the requirements of, and be in compliance with, NIST standards and guidelines within one year of their respective publication dates unless otherwise directed by OMB. The one-year compliance date for revisions to NIST publications applies only to new or updated material in the publications. For information systems under development or for legacy systems undergoing significant changes, agencies are expected to meet the requirements of, and be in compliance with, NIST standards and guidelines immediately upon deployment of the systems.” Visibility of how your sensitive data is being handled through it's lifecycle will.be essential; even when it's sitting somewhere within your supply chain. Seclore Data Centric Security is a strong part of NIST and achieving zero trust. https://lnkd.in/efiMejPG #NIST800171 #SecurityRequirements #NIST800171A #AssessmentProcedures #CUI #OMBCircularA130

7

Tired of managing security testing across a scattered team? AttackIQ Mission Control centralizes control testing for faster remediation and improved ROI. 📅 Join Jose Barajas at 10 AM PT/12 PM CT/1 PM ET on July 18th to learn how AttackIQ Mission Control streamlines security operations for organizations. Discover how to seamlessly orchestrate testing across departments and locations, gain insights specific to your role with role-based dashboards, and simplify testing workflows for faster results. ➡ Register today and optimize your #SecurityOperations: https://bit.ly/3RZa5hw #LinkedInLive #Cybersecurity

13

Enjoyed reading this post from CISA Director, Jen Easterly on the USDA's adoption of FIDO Protocols, referencing the CISA's publication from the 20th: "USDA’s success story should inspire all enterprises to migrate to FIDO authentication". Referencing the CISA publication: "Authentication technologies that do not involve FIDO or public key infrastructure (PKI)—a security framework based on public key cryptography—to support confidentiality and integrity will only continue to put organizations at risk by allowing malicious cyber actors initial access to their networks via credential phishing attacks."

1

This is an excellent discussion regarding the trustworthiness of AI systems between Elham Tabassi, Chief AI Advisor at National Institute of Standards and Technology (NIST), and Chris Benson, principal AI research engineer at Lockheed Martin. Elham sets the scene perfectly by reminding us that AI is inherently multidisciplinary, so the assessment of risk factors cannot be done in isolation. Context is key!!! Lots of great commonalities between the AI RMF and other NIST activities such as Ron Ross's ongoing efforts on systems security engineering (https://lnkd.in/em5QVfAB), Victoria Yan Pillitteri's work on Risk Management Framework (https://lnkd.in/eYT3yyAR), and Naomi Lefkovitz' generation of the Privacy Risk Management Framework (https://lnkd.in/eD6RFy2H), while she was at NIST. Thankful to have had the opportunity to work on some of these efforts over the years. Key risk mitigation principles remain relevant for each variant of emerging technologies - and are applicable to both information and operational technologies... (https://lnkd.in/eq2yMa5E) Did I just get through a post without mentioning #QuantumCyberRisk? :-) Thankful for that. #Deloitte #CyberRiskManagement Adnan Amjad, Mark Nace, Emily Mossburg, David Caswell, PhD, Ed Van Buren, Timothy Li, Robert Stradtman, Jim Rowan, Nitin Mittal, Vikram Kunchala, Clare Harding, Deborah Golden, Duleesha Kulasooriya

27

1 Comment