Alan Crouch

Brand recognition is a critical part of company awareness. A great example I just experience this week from Robert 🦄 Slaughter and the team over at Defense Unicorns. While helping a partner implement kubernetes at the edge (middle of the ocean where k8s belongs right?) we were evaluating Zarf (https://zarf.dev/). I recognized their mascot and immediately knew that the Defense Unicorns were behind it. This is a testament to the efforts that they put in their brand and mascot, not to mention the solution is open source tool is pretty awesome. Measuring brand recognition isn't easy....my feedback is, it's working! Keep up the good work folks.

39

12 Comments

I've just about had it up to here with git(lab/hub) access tokens making it back into code bases as they seem to do today. Here's one example that would have given away more or less all of Python, just to scare you. The whole phenomenon is so harebrained, you can't even begin to put your finger on what's going so terribly wrong here: - Access tokens as a replacement of passwords, clearly is not working. - Also: tokens have this pretense of 'being safer' than including passwords; maybe that's why people do it? - It lays bare one of the glaring Achilles' heels of public cloud - sharing identities between different services. If this is the best we can do, let's all go home and do something useful with our lives. - The people doing this should definitely know better. I mean - if they don't, who on God's green earth _does_? https://lnkd.in/etCic4KM #cybersecurity EDIT: lost some of my temperament, and some of the cuss words.

8

1 Comment

This is sobering. https://lnkd.in/gmYCzE5K I can see where an organization based on budget and tech complexity might want to adopt a defense-in-depth approach to security, but IMO if you can afford it and bring resources to bear, the perceived inconvenience of a zero-trust approach is far, FAR better to protect your assets and your customer data (PII/PHI/etc.) From an interest-balancing perspective, NOT being in the news is worth what some might see as bothersome. Every IT professional's goal should be "stay out of the news."

11

1 Comment

Federal agencies have a plethora of cybersecurity tools all gathering critical data to defend from cyberattacks. #BoozAllen is helping them integrate that data to better protect themselves through its work on the Cybersecurity and Infrastructure Security https://lnkd.in/egbRw35n

2

It took me a couple of years working with the DoD before I realized that there are two competing definitions of DevSecOps in wide use. In this post, I explain the two, how I think we got here, the problems we’re facing, and how can easily address fix the bug.

16

2 Comments

As everything rapidly moves to the cloud this is scary. One of the main reasons to move to the cloud protection and survivability of your data is completely negated.

13

5 Comments

SKILLS-BASED HIRING is increasingly being adopted. Since 2109, iQ4 has invested significantly to be a market leader in Learning and Employment Record system - including a Digital Wallet that translates resumés, academic and military transcripts, and certifications into skills (professional, IT, operational/leadership) so Wallet holders can explore career pathways and get matched to vacancies. Read more in the attached article.

15

🤔 Well said Help Net Security “The tool excels in distributing software across various secure development settings, including edge and embedded systems, secure clouds, data centers, and local setups.” “Zarf simplifies deployments into a single compressed file containing everything your app needs. It can be installed without an internet connection. Its declarative approach ensures consistent application deployment every time. The tool can also incorporate legacy code into modern DevSecOps environments, facilitating deployment.” https://lnkd.in/eRwgmKwG

57

2 Comments

DoD DIGITAL ENGINEERING—Why GAME THEORY says that Digital Engineering approaches will WIN. DoD leadership assert that the best “Materiel Management” way forward is driven by Digital Engineering Ecosystems (DEEs) populated by numerous vendors’ analysis tools and supported by Authoritative Source of Truth (ASOT) data which are interoperable via open-specification APIs. This is a bold move. Part of the genius of this assertion is that COOPERATIVE and FORGIVING Game Theory strategies tend to both win and reproduce. As the following video notes, “Small islands of cooperation can emerge and spread, ultimately winning.” This is the vision for DEEs and why cooperative and forgiving ASOT and INTEROPERABILITY strategies will ultimately maximize DoD Materiel Management, Acquisition & Sustainment, and Digital Engineering success.

2

1 Comment

The zero trust overlays really put the picture together of what it will take to get to a true zero trust solution . #Iwork4Dell

1

It will be interesting to see how this impacts #CMMC, especially internationally. Haven't had a chance to read it yet, but I'm looking forward to it! #cyber #cybersecurity #reciprocity #informationsecurity #infosec #DoD #NIST #NIST800171 #CMMC2

24

1 Comment

DoD CIO announces the public release of the DoD Cybersecurity Reciprocity Playbook. This playbook, referenced in the DSD's Reciprocity Memo, provides guidance for employing cybersecurity reciprocity in DoD systems. It defines reciprocity as it relates to cybersecurity, discusses the benefits and risks, and includes example possible use cases. For more information read the playbook here: https://lnkd.in/e4K3d8DQ

1,047

61 Comments

Vendor Provided Containers - Part 4 The "Vendor Dependency Conundrum". So you do FedRAMP or DOD/IL* work and you have a POAM (Plan of Action and Milestones). For the folks who don't do Public Sector work, this is basically a list of all of your compliance violations and vulnerabilities. What happens when you have a vulnerability in a vendor provided container? Specifically for something the vendor doesn't produce or patch? Often companies will make this a "Vendor Dependency". A "Vendor Dependency" is basically saying, "we'll wait until the upstream vendor patches it". But lets be real for a moment. The choice to use the "Vendor Provided Container" is yours and yours alone. Making it a vendor dependency is passing the responsibility for something that is most definitely the responsibility of the Cloud Service Provider (the authorized service). I described in my previous posts how vendor provided containers are woefully inadequate for production use (not hardened, not stripped, missing FIPS, etc). Long story short, the burden is still on the Cloud Service Provider (or consumer of those containers) to do all of the above. So while vendor provided containers are good to get started, they shouldn't be anywhere near a production environment. Going forward we need vendors to move past creating "development" containers, because that's really all they're good for. We need a standard for containers coming from vendors and if vendors are truly pursuing their CISA pledge of Secure by Design, they would harden them and strip them according to best practices. If they want to make it easy for DOD/FedRAMP customers, they would STIG harden them, and provide them with valid FIPS libraries. In summary, don't use vendor provided containers. You need to build your own or work with a vendor that builds and hardens container images as a service. Building your own images has a real cost to it too. It's also a discipline to do it fast and do it well. Teams are not usually equipped to take this on and often haphazardly do this work.

19

"Failing to leverage reciprocity to the greatest extent possible can lead to redundant and resource-intensive efforts. Without recognizing the assessments conducted by other entities, the organization might be compelled to undertake its own comprehensive evaluations of systems and networks, even when similar assessments have already been performed by trusted partners. This results in a wasteful allocation of time, manpower, and financial resources, hindering the organization’s ability to efficiently manage and enhance its cybersecurity posture." Haven't read the whole playbook yet, but jumping straight to the above quote, I am excited to see the emphasis on reciprocity being pushed from the highest levels. This will make us better as a DoD, and hopefully will help some future action officers to not have as many late nights trying to de-mystify the ATO.

28

The DoD Zero Trust Roadmap contains 152 functions and activities, divided across 7 pillars, intended to drive DoD agencies and defense industrial base contractors to a new era of zero trust security. This is a challenging task, but one that must happen for our national security. Xage Security has published a quick intro to the roadmap, and a robust mapping of how Xage supports 90% of the requirements. Watch the embedded video for a 3 minute summary, or request the PDF for a deep dive into how to achieve the Zero Trust Roadmap objectives.

1

CompTIA shares similar goals to D8140 by listening to technologists, corporations, non-profits, and governments globally. Our certifications span IT, cybersecurity, data, software development, and AI, addressing the same needs as D8140.

10

1 Comment

Booz Allen Hamilton has launched aiSSEMBLE Baseline™, an open-source iteration of their aiSSEMBLE solution. This technology is set to revolutionize the engineering and deployment of AI systems, making them more efficient, repeatable, and accessible. Key Takeaways: - aiSSEMBLE Baseline is a first-of-its-kind, open-source AI solution built to simplify the development and deployment of AI systems. - The solution leverages Booz Allen's industry-leading AI reference architecture, data delivery, and machine learning patterns. - aiSSEMBLE Baseline maximizes mission impact, minimizes vendor lock-in, and expands ease of use and access to game-changing innovation. Booz Allen offers aiSSEMBLE Baseline free of charge to government, academic, nonprofit, and commercial entities. By making aiSSEMBLE open source, Booz Allen is empowering people to change the world through collective ingenuity. This move will accelerate the impactful delivery of AI at enterprise scale and ensure repeatability for future AI solutions. #AI #OpenSource #Innovation #BoozAllenHamilton #aiSSEMBLE

5