John Linkowsky, CISSP

*WiCyS Delaware Valley EVENT ALERT!* Join us for Offensive Security War Stories on Tuesday, November 19th. This is a great event for security practitioners looking to improve their ethical hacking skills/knowledge and security leaders who want to understand the innerworkings of penetration testing and real-life tactics that can be used to compromise your organization. #wicys #cybersecurity #informationsecurity #penetrationtesting #ethicalhacking

10

1 Comment

Lehigh University understands the critical importance of robust cybersecurity defenses. They implemented Armis Centrix™ for VIPR Pro – Prioritization and Remediation to streamline their efforts and significantly improve their security posture. Learn how Armis Centrix™ helped Lehigh University: - Reduced cybersecurity risks by 40% through effective prioritization and remediation of vulnerabilities. - Enhanced visibility across their network, enabling them to identify and address threats faster. - Achieved faster response times to potential threats, minimizing potential damage. Read the full case study now: https://bit.ly/4755Ln5 #Armis #ArmisCentrix #VulnerabilityManagement #VulnerabilityPrioritization #Cybersecurity

15

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

This could be the source of your "aha" moment with CMMC. Trust me when I say that there's a lot of FUD and myths in the marketplace, and there's a lot of sleight of hand being performed by people who really are not the experts they pretend to be in the CMMC echo system. Here's a few quick screening questions to ask. 1. Is CUI classified information? 2. Did DoD develop the requirements for protecting my sensitive information? 3. If I don't meet a particular control, I can always get an extension of up to a year to do so, correct? 4. Do I just have to meet 80% of the assessment objectives in each control to be certified? 5. Do I pass the assessment and receive a CMMC Level 2 certification if I meet 75% of the requirements? If you encounter hesitation on any of these questions by any company you're asking to help you comply with CMMC, I would suggest you keep looking. Better yet, go the NCMBC web site and pay the admission. It's $130 per person, and you get food, entertainment and fellowship with other managers and subject matter experts as you plot your journey through the CMMC echo system. Hope to see you there. It's an in person event at McKimmon Center of North Carolina State University. (https://lnkd.in/eitYSGUf, McKimmon Conference and Training Center at NC State University, 1101 Gorman St, Raleigh, NC 27606 (919) 515-2277). Registration link is in Laura's post.

1

ECS selected #Axonius to support DHS's CDM program. Axonius will provide comprehensive #Cybersecurity asset visibility and vulnerability management, enabling efficient risk management: https://dy.si/m5nFJ

2

"(1) Affirming Official. The Affirming Official is the senior level representative from within each Organization Seeking Assessment (OSA) who is responsible for ensuring the OSA’s compliance with the CMMC Program requirements and has the authority to affirm the OSA’s continuing compliance with the specified security requirements for their respective organizations. (2) Affirmation content. Each CMMC affirmation shall include the following information: (i) Name, title, and contact information for the Affirming Official; and (ii) Affirmation statement attesting that the OSA has implemented and will maintain implementation of all applicable CMMC security requirements to their CMMC Status for all information systems within the relevant CMMC Assessment Scope." #cmmc #dod #cybersecurity

25

💡 Have you considered becoming a CMMC Certified Professional (CCP)? 👉 The requirements can be difficult to navigate, and don't always provide future CCPs with a clear picture of exactly what is required to become certified 👉 Hopefully this can help someone interested in pursuing the CCP better understand the costs associated with this pursuit ❓ If you have questions about whether becoming a CCP is the right path for you, or if it would provide value to you or your organization, please reach out #CMMC #CCP #cui #dod

16

5 Comments

#cmmc coming soon? Here is what I understand: Publication in by end of month, which starts a 60 day comment period. After the comments are addressed, then final rule will be submitted. After final rule is submitted, then it will start being added to contracts in a phased approach. Mid 2025?

2

For those in the Defense Industrial Base (DIB) and those who supply the DIB, you better already have a plan to be compliant with the upgrading of CMMC to v2 and ITAR Compliance. Check out this Guide for Defense Contractors Sponsored Post. Discover more: https://lnkd.in/gg9sA78b #cybersecurity #compliance #CMMC #ITAR #blog

7

1 Comment

Prepare for CMMC Success The CMMC framework is a critical component of national security. As a CMMC Certified Assessor (CCA), you'll be equipped to guide organizations in meeting NIST 800-171 and cybersecurity maturity requirements. Register today with ecfirst and become a trusted expert in CMMC compliance. #CMMC #NIST #Cybersecurity

4

I found an interesting piece of information that may shed some light on the upcoming CMMC final rule regarding C3PAO data collection and retention: - The CMMC proposed rule states, "(10) Unless disposition is otherwise authorized by the CMMC PMO, m̳a̳i̳n̳t̳a̳i̳n̳ ̳a̳l̳l̳ ̳a̳s̳s̳e̳s̳s̳m̳e̳n̳t̳ ̳r̳e̳l̳a̳t̳e̳d̳ ̳r̳e̳c̳o̳r̳d̳s̳ ̳f̳o̳r̳ ̳a̳ ̳p̳e̳r̳i̳o̳d̳ ̳o̳f̳ ̳s̳i̳x̳ ̳(̳6̳)̳ ̳y̳e̳a̳r̳s̳.̳ ̳S̳u̳c̳h̳ ̳r̳e̳c̳o̳r̳d̳s̳ ̳i̳n̳c̳l̳u̳d̳e̳ ̳𝒂𝒏𝒚 ̳m̳a̳t̳e̳r̳i̳a̳l̳s̳ ̳p̳r̳o̳v̳i̳d̳e̳d̳ ̳b̳y̳ ̳O̳S̳C̳, generated by the C3PAO in the course of an assessment, any working papers generated from Level 2 Certification Assessments; and materials relating to monitoring, education, training, technical knowledge, skills, experience, and authorization of all personnel involved in inspection activities; contractual agreements with OSCs; and organizations for whom consulting services were provided." However, in the '𝘚𝘶𝘣𝘮𝘪𝘴𝘴𝘪𝘰𝘯 𝘧𝘰𝘳 𝘖𝘔𝘉 𝘙𝘦𝘷𝘪𝘦𝘸; 𝘊𝘰𝘮𝘮𝘦𝘯𝘵 𝘙𝘦𝘲𝘶𝘦𝘴𝘵' document, it states, "T̳h̳e̳ ̳o̳r̳g̳a̳n̳i̳z̳a̳t̳i̳o̳n̳a̳l̳ ̳a̳r̳t̳i̳f̳a̳c̳t̳s̳ ̳a̳r̳e̳ ̳p̳r̳o̳p̳r̳i̳e̳t̳a̳r̳y̳ ̳t̳o̳ ̳t̳h̳e̳ ̳O̳S̳C̳ ̳a̳n̳d̳ ̳𝒘𝒊𝒍𝒍 𝒏𝒐𝒕 ̳b̳e̳ ̳r̳e̳t̳a̳i̳n̳e̳d̳ ̳b̳y̳ ̳t̳h̳e̳ ̳a̳s̳s̳e̳s̳s̳m̳e̳n̳t̳ ̳t̳e̳a̳m̳ ̳u̳n̳l̳e̳s̳s̳ ̳e̳x̳p̳r̳e̳s̳s̳l̳y̳ ̳p̳e̳r̳m̳i̳t̳t̳e̳d̳ ̳b̳y̳ ̳t̳h̳e̳ ̳O̳S̳C̳. To preserve the integrity of the artifacts reviewed, the OSC creates a hash of assessment evidence (to include a list of the artifact names, the return values of the hashing algorithm, and the hashing algorithm used) and retains the artifact information for six years." It's clear that there will be changes coming in the CMMC final rule. Thoughts?

26

19 Comments

"A comprehensive guide authored by Dean Parsons, SANS Certified Instructor and CEO / Principal Consultant of ICS Defense Force, emphasizes the growing need for specialized ICS security measures in the face of rising cyber threats." #criticalinfrastructure #ICS #cybersecurity

3

CMMC Level 2 compliance is crucial for DIB organizations handling CUI, involving 110 controls from NIST SP 800-171 and 320 assessment objectives in NIST SP 800-171A to ensure cybersecurity readiness. Download this eBook to explore these controls and objectives in detail. https://lnkd.in/ej3NZ5gj #CMMC #NIST #Cybersecurity

9

Getting ready to lead discussions in Boston this week. Come join to talk about supply chain attacks - think about all your devices, not just software - and better security testing in your software development lifecycle.

4

Armis is uniquely capable of managing and prioritizing risk in complex higher education environments. Learn how Lehigh is using Armis to see, protect, and manage IT, IoT, OT, all the T's!

7

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9