Rob Fuller

Our director is restoring the warrior ethos – a priority for Secretary of Defense Pete Hegseth – in the cyber domain. At the DOD CIO Cyber Workforce Summit he urged cyber leaders to take cyberattacks personally, impose costs on adversaries, and double-down on cyber excellence.

312

8 Comments

PRC state-sponsored cyber actors are targeting critical infrastructure. With the National Security Agency, Federal Bureau of Investigation (FBI) & international partners, read our joint advisory about this threat: https://go.dhs.gov/icS   PRC state-sponsored advanced persistent threat (APT) actors continue to target critical infrastructure globally. These actors are exploiting edge routers to establish persistent, long-term access to telecommunications, transportation, and defense networks. This is not opportunistic—it’s strategic. We strongly encourage all critical infrastructure operators to review the advisory and implement the recommended mitigations. 📘 Read the full advisory: https://go.dhs.gov/icS

474

12 Comments

New joint CISA/NSA/CCCS report confirms that PRC state-sponsored actors are using the BRICKSTORM backdoor to maintain longterm, covert access to VMware vCenter and ESXi systems across government and IT infrastructure. The operation relies on advanced tradecraft—including nested TLS, DoH, rogue VMs, and snapshot theft—to evade detection and extract credentials while remaining persistently embedded. Authors/Researchers: Cybersecurity and Infrastructure Security Agency National Security Agency Canadian Centre for Cyber Security Alert: https://lnkd.in/e4qrGB9w Analysis: https://lnkd.in/eE6c_mzg PDF Report: https://lnkd.in/emSwAxTh #CISA #BRICKSTORM #Cyber #Threats #StateSponsored #CTI #InfoSec #VMware #Malware #ESXi

54

1 Comment

#OSINT isn’t just for experts anymore. Horizon Identity empowers any team to uncover patterns, links, and real-world identity details - without needing OSINT skills or special training. One search bar for access to more than 550 publicly available data sources and more than 1,500 endpoints to make your investigation easy. Learn more here: https://hubs.la/Q03rsWqm0 #cai #investigations #shadowdragon #horizonidentity #pai #osintforgood #realtimeintel

23

MITRE ATT&CK v18 lands today with a groundbreaking update to ATT&CK's threat detection taxonomy. This restructuring—announced during ATT&CKcon by MITRE ATT&CK defense lead Lex Crumpton—will help cybersecurity teams better connect the dots across adversary behaviors, enabling more effective and informed defenses. Read more on Inside Cybersecurity: http://spklr.io/6047BzpN3 #ATTACKcon #Cybersecurity #ThreatInformedDefense #MITREattack

328

6 Comments

The posters may change over time, but the fundamentals of OPSEC do not: 1) Identify your critical information 2) Evaluate threats 3) Analyze vulnerabilities 4) Assess risks 5) Apply countermeasures 6) Periodically reassess. Visit NCSC’s Operations Security site: https://lnkd.in/eQ6qKxs4

176

5 Comments

𝗧𝗵𝗲 𝗗𝗼𝗗 𝗜𝘀 𝗢𝘃𝗲𝗿𝗵𝗮𝘂𝗹𝗶𝗻𝗴 𝗜𝘁𝘀 𝗥𝗶𝘀𝗸 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸 Last week's RFI from the US Department of Defense marks the beginning of its "blow up" of its current Risk Management Framework (RMF). 𝗪𝗵𝗮𝘁'𝘀 𝘁𝗵𝗲 𝗶𝘀𝘀𝘂𝗲? The RMF (as it stands) is slow, redundant, and overly compliance-driven. It burdens cyber and acquisition teams with overwhelming amounts of paperwork and static checklists, often producing risk outputs that obscure actual mission readiness. 𝗜𝗻 𝘀𝗵𝗼𝗿𝘁: It's a dated framework built for an obsolete era in which software deployments don't happen weekly and adversaries don't exploit zero-day vulnerabilities at an industrial scale. 𝗪𝗵𝘆 𝗻𝗼𝘄? The operational environment has shifted and is continuing to do so at a dramatic pace. The volume of vulnerabilities is skyrocketing, threat actors are faster and more adaptive and mission systems, especially those built on modern DevSecOps pipelines, require near real-time visibility into cyber risk. 𝗜𝗻 𝘀𝗵𝗼𝗿𝘁: The current RMF isn't keeping up, and the toll that this is taking has become too much for leadership to bear. 𝗪𝗵𝗮𝘁'𝘀 𝘁𝗵𝗲 𝗽𝗹𝗮𝗻? The DoD is exploring a much-needed streamlined approach with fewer control redundancies, greater automation, and continuous security assessments embedded in the software development lifecycle. Rather than certifying systems and solutions at a single point in time, the new approach would rely on control inheritance, platform security baselines, and threat-informed updates. 𝗜𝗻 𝘀𝗵𝗼𝗿𝘁: Adopt an assessment approach that's designed from the beginning to reduce overhead and move faster. 𝗧𝗵𝗲 𝗯𝗲𝗻𝗲𝗳𝗶𝘁𝘀? - More timely insights into rapidly evolving cyber risks - Fewer bottlenecks for innovation and implementation - Better alignment between security assurance and operational needs 𝗧𝗵𝗲 𝘂𝗹𝘁𝗶𝗺𝗮𝘁𝗲 𝗴𝗼𝗮𝗹: Help commanders understand how cyber risks could directly impact mission readiness and operational outcomes. 𝗕𝗿𝗼𝗮𝗱𝗲𝗿 𝘀𝗼𝗰𝗶𝗲𝘁𝗮𝗹 𝗶𝗺𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀? This shift isn't only about the DoD. It signals a more widespread truth for any organization that needs to manage cyber risk at scale (so, nearly all entities). Nowadays, we need frameworks and assessment processes that can reflect the swiftly evolving cyber risk landscape. Static approaches won't cut it. Stakeholders need real-time visibility and credible, contextualized quantification that helps them make decisions based on impact. That's the future the DoD is trying to build: an environment where cyber risk is continuously assessed and directly tied to business outcomes. 𝘐𝘵'𝘴 𝘵𝘩𝘦 𝘴𝘢𝘮𝘦 𝘧𝘶𝘵𝘶𝘳𝘦 𝘵𝘩𝘢𝘵 𝘮𝘰𝘥𝘦𝘳𝘯, 𝘰𝘯-𝘥𝘦𝘮𝘢𝘯𝘥 𝘤𝘺𝘣𝘦𝘳 𝘳𝘪𝘴𝘬 𝘱𝘭𝘢𝘵𝘧𝘰𝘳𝘮𝘴 𝘢𝘳𝘦 𝘦𝘯𝘢𝘣𝘭𝘪𝘯𝘨. https://lnkd.in/dGCPWgd6 

27

4 Comments

After DHS did not renew its funding contract for reasons unspecified, MITRE’s 25-year-old Common Vulnerabilities and Exposures (CVE) program was slated for an abrupt shutdown on April 16, which would have left security flaw tracking in limbo. CISA stepped in to provide a bridge. A CISA spokesperson sent CSO a statement saying, “The CVE Program is invaluable to cyber community and a priority of CISA. Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We appreciate our partners’ and stakeholders’ patience.” Sources say the contract extension will last 11 months. Yosry Barsoum, vice president and director of the Center for Securing the Homeland at MITRE, commented: “Thanks to actions taken by the government, a break in service for the Common Vulnerabilities and Exposures (CVE®) Program and the Common Weakness Enumeration (CWE™) Program has been avoided. As of Wednesday morning, April 16, 2025, CISA identified incremental funding to keep the Programs operational. We appreciate the overwhelming support for these programs that have been expressed by the global cyber community, industry, and government over the last 24 hours. The government continues to make considerable efforts to support MITRE’s role in the program and MITRE remains committed to CVE and CWE as global resources.” https://lnkd.in/gPhB8vVQ

170

12 Comments

Former NSA Chief Paul Nakasone’s conversation with Jeff Moss at the recent Defcon security conference hinted at the power of cyber defense partnerships in an ever-changing threat landscape. “Despite all the advanced tools and countermeasures deployed today, the best cybersecurity defenses in the world are only stopping about 6% of cyber-attacks globally. No matter how much policies or leadership evolve, the architecture of our technology itself carries unfixable weaknesses that sophisticated adversaries exploit. We need a paradigm shift in how we approach security one that acknowledges these inherent flaws and innovates beyond traditional defensive measures.” #strongpublicprivatepartnerships #aiisac #threatinformationsharing

32

The DoD CIO's office released a memorandum establishing the policy defining the values for SP 800-171r3 Organization-Define Parameters (ODP). While #CMMC will remain on SP 800-171r2 for the foreseeable future, this memo is an indication that the DoD is preparing for the transition from revision 2 to revision 3. This is likely the first 'flare' showing CMMC will transition to revision 3 in the future, but probably not for another couple years to give organizations time to prepare. So why is this memo an important first step in transitioning? When NIST updated the requirements, they included ODPs to provide flexibility to agencies requiring SP 800-171r3. The previous version of SP 800-171r2 left it up to the implementer to determine what was appropriate. This led to confusion as organizations implementing SP 800-171r2 frequently asked "What is the correct setting?" The answer was always, "the setting appropriate for you, based on your risk appetite." I'm excited to dig into the 53 page memorandum to see what guidance was specified. The DoD consulted DoD offices, external government agencies, and subject matter experts when selecting the values basing them on industry standards, so I don't expect too many surprises. What do you think of the memo? Did any of the specified values surprise you? Link to the full memo in the comments below. 👇

13

3 Comments