John Ramsey’s Post

I’m happy to share that I’ve obtained a new certification: Boardroom Certified Qualified Technology Expert (QTE) from Digital Directors Network! Special thanks to Bob Zukis for leading this course and his commitment to advancing the cybersecurity profession. Also what a great group of cybersecurity leaders to take this course with.

You could have a rock-solid Zero Trust implementation, a flawless SOC2 review, or even the best EDR platform on the market, but none of those will help you protect against an adversity that can easily fall through the mountains of security controls without notice: The Insider Threat. A report released by the Air Force IG in December provides more insight into the unauthorized disclosure of classified documents by Jack Teixeira, including a detailed look at compliance with policy, procedures, and standards, and unit behavior leading up to the leak. While the evidence indicates that one individual's actions caused this outcome, various direct and indirect factors played a role in the events. Addressing many of these factors could have significantly reduced the impact and potentially prevented the event altogether. Failure to Report Incidents: Members of his unit witnessed numerous instances of questionable activity and observed situations related to "intelligence-seeking behavior." However, none of these events were reported. Inconsistent Reporting Guidance: Guidance on how and who to report incidents was inconsistent across DoD and AF documentation. Additionally, the report mentions that the "total number of governing regulations regarding security created misconceptions and misunderstandings." Conflation of Classified System Access with “Need to Know” Principle: Despite Teixeira having the appropriate clearance, there's uncertainty about whether his role as an IT system operator mandated access to systems and data essential for his job functions. The report is essential reading for all security professionals. It serves as a reminder that neglecting a robust Insider Threat program can pose significant risks to your organization. Clear policies and procedures must be established, coupled with comprehensive training on recognizing insider threats and specific steps tailored to your organization. Enforced policies ensure that all individuals have access to the information necessary for their respective roles. No slew of technical tools can protect you against the human factor in security. The report can be found here: https://lnkd.in/eFubSi4K

I’m happy to share that I’m starting a new position as Owner and Principal Consultant at Ramsec!

A few weeks ago, the DoD OIG released a special report outlining common cybersecurity weaknesses found in audit reports focusing on DoD contractors over the past 5 years. As anyone who has been in this space for quite some time knows, DFARS 252.204-7012 requires contractors and grantees who maintain and process Controlled Unclassified Information (CUI) to implement security controls specified in NIST SP 800-171. The results, as some may guess, are not at all surprising. Of the 5 reports that accessed 32 contractors, the audit found 116 recommendations specific to cybersecurity weaknesses. Of the weaknesses found within the report, the top three systemic weaknesses identified are as follows: 🚫 Multifactor authentication or strong passwords not enforced 🚫 CUI not protected on removable media 🚫 Network and system vulnerabilities not identified or mitigated in a timely manner The report states that DoD had 183,562 active contracts as of October 1, 2023. While the sample size of the report is quite small, it's not hard to imagine what the scope of a full audit against all contractors would look like. What I am most curious about is how the results for these vendors stacked up against their self-assessment scores within SPRS. It would be interesting to know what the discrepancy between the contractors' self-assessment scores at the time of entry were versus what the OIG found for these contractors within the reports. Having led organizations through the NIST-800-171 audit process several times, navigating the 110 controls across an organization can be daunting. Submitting your scores seems like submitting them into the ether. Of course, CMMC 2.0 is coming (at some point!). While CMMC, the new model, is much simpler than the first iteration, self-assessments will still be a thing. And with that, the above information doesn't give much confidence in what the security practices of most contractors are like. It is discouraging that even the basics are not being followed by many. Here is a link to the report for those who want to read through it: https://lnkd.in/ecpYR4vk

I’m #hiring. Know anyone who might be interested?

I’m happy to share that I’m starting a new position as VP of Engineering at DUST Identity!

I'm really excited to be part of the digital transformation journey to create a more sustainable and secure supply chain. A huge accomplishment by DUST Identity. We are creating the future with our Anchored Digital Thread technology that securely links things and their data. #supplychainsecurity #digitalthread #digitaltransformation https://lnkd.in/eNF8C2nj