PEO IEW&S ’s Post

It may be the last day of Cybersecurity Month, but securing access to the Army's IT resources is a 24/7 365 day requrement. E-ICAM for FY25 launched to support the Army Digital Transformation Strategy and  Zero Trust mission, providing standardized Access Management and enhanced cybersecurity. E-ICAM is committed to:  -Standardizing access management across all systems  -Enhancing cybersecurity measures to protect critical data  -Improving operational efficiency and readiness through secure, streamlined user access This could-based application is another step forward in fortifying the Army’s digital future and ensuring secure, mission-critical operations. #EICAM #ZeroTrust #ArmyDigitalTransformation #Cybersecurity #AccessManagement #DigitalFuture #ArmyInnovation 

The DoD just released their Defense Industrial Base Cybersecurity Strategy for 2024. "Cybersecurity is identified by the DIB SSP [Defense Industrial Base Sector-Specific Plan] as “𝘢𝘳𝘨𝘶𝘢𝘣𝘭𝘺 𝘵𝘩𝘦 𝘮𝘰𝘴𝘵 𝘶𝘳𝘨𝘦𝘯𝘵 𝘪𝘯𝘧𝘳𝘢𝘴𝘵𝘳𝘶𝘤𝘵𝘶𝘳𝘦 𝘱𝘳𝘰𝘵𝘦𝘤𝘵𝘪𝘰𝘯 𝘪𝘴𝘴𝘶𝘦 𝘧𝘢𝘤𝘪𝘯𝘨 𝘵𝘩𝘦 𝘕𝘢𝘵𝘪𝘰𝘯.”" "Today, the Department conducts contractually required Medium or High NIST SP 800-171 DoD Assessments only for prioritized DIB contractors to verify overall compliance with DFARS 252.204-7012 and implementation of NIST SP 800-171 requirements. In the future, the Department will continue to do so through the CMMC program, which will establish a large-scale verification capability, allowing self-assessment for some requirements, leveraging independent assessments on DIB companies that will receive CUI associated with the Department’s programs, conducting assessments on the subset of DIB companies that will receive CUI associated with the Department’s most critical and sensitive programs and technologies, and reinforcing cooperation between the Department and industry in addressing evolving cyber threats. Results of CMMC and DoD High and Medium assessments must be posted in the Supplier Performance Risk System to meet contract eligibility requirements."

OK...so some light reading this morning. A few thoughts.... First, I'm curious about why this strategy document doesn't include Operational Technology (OT) cybersecurity in any way, shape, or form? With NDAA Sec 1505 clearly defining the requirement, passing those requirements on to the DIB seems like an absolute need. I've read this and see no reference to OT, Industrial Control Systems (ICS), SCADA, or IoT cybersecurity...only IT. The good news is, I've walked the manufacturing floors of a few Defense weapon/platform manufacturers who are taking it upon themselves to position OT cybersecurity due to their vision of the huge gap they have in their cybersecurity coverage. OT Systems are talking on their networks, using protocols not covered by IT security systems and they know it. Kudos to them. Between building systems (power, water, HVAC, etc.), security systems (IoT of security cameras, motion detectors, badge readers, etc.), and manufacturing systems (automated welding, painting, and assembly systems, etc.) the OT attack surface of many of these DIB entities is a significant target for our well-funded, well-motivated adversaries on both the wired and wireless (6LowPan, Bluetooth/BT low energy, Cellular, Zwave, 802.15.4/2.4GHz, etc.) mediums. The point is...don't forget OT/ICS/SCADA/IoT! #Cybersecurity #DEBCSStrategy #DOD #DODCIO

🔒 Enhancing Cybersecurity: Breaking Down the Cyber Kill Chain 🔒 As we navigate the complex landscape of cybersecurity, understanding the Cyber Kill Chain® (https://lnkd.in/ekt9mydB) is crucial 🚀. 💡 The model, developed by Lockheed Martin back in 2011, has become a cornerstone in cybersecurity. It's not just a framework, but a powerful tool that empowers companies to understand and mitigate cyberattacks. By breaking down the attack process into manageable phases, it equips organisations of all sizes and industries with the knowledge to develop comprehensive defence strategies. Here’s a breakdown of each stage and some proactive measures companies can take: Reconnaissance 👀 👉 Defence Tip: Implement robust network monitoring and employ threat intelligence to detect unusual scanning or information-gathering activities. Weaponization ⚔ 👉 Defence Tip: Use sandboxing and advanced threat detection tools to analyse and block malicious payloads before they can be weaponized. Delivery 📩 👉 Defence Tip: Educate employees on phishing and social engineering tactics and utilize email protection solutions to ensure strict sender/recipient validation and to prevent malicious attachments and links from reaching inboxes. Exploitation 👾 👉 Defence Tip: Regularly update and patch systems to fix vulnerabilities and conduct regular penetration testing to identify potential exploits. Installation 💾 👉 Defence Tip: Deploy endpoint protection and detection systems to identify and stop the installation of unauthorized software or backdoors. Command and Control (C2) 🎮 👉 Defence Tip: Monitor network traffic for unusual patterns and use intrusion detection/prevention systems (IDS/IPS) to disrupt C2 communications. Actions on Objectives 🏆 👉 Defence Tip: Protect your Crown Jewels (encryption & access controls) and implement data loss prevention (DLP) and anomaly detection tools to quickly identify and respond to data exfiltration or system manipulation. Which stage do you believe is the most critical to focus on? 🚀 My vote goes to the Delivery stage. The better I can protect my front door🚪, the fewer intruders 💀 I’ll have to worry about. Would you spend your extra💲here? Or do you see other stages/measures where the CS-ROI (CyberSecurity - Return On Investment) would be higher ⬆? 🌟 What additional strategies have you found effective in your experience? ---------- ♻️ REPOST and teach your network something new. 👇 COMMENT and share your experiences and thoughts. #CyberSecurity #CISO #CIO #DPO #InfoSec #CyberKillChain #ThreatDetection #DataProtection #CyberDefense

U.S. Cyber Command is enhancing its premier training platform, the Persistent Cyber Training Environment (PCTE), by integrating more complex, multidomain scenarios to better prepare for increasingly sophisticated cyber threats. The PCTE, managed by the Army’s Program Executive Office Simulation, Training and Instrumentation since 2015, allows cyber mission forces worldwide to engage in individual and collective training, and mission rehearsals. This online client has evolved significantly, with newer versions offering advanced mission rehearsal capabilities and the integration of real-world cyber threat scenarios, reflecting the tactics of adversaries like China, Russia, and Iran. The platform also emphasizes usability improvements, such as the "Rapid Range" for simpler scenario creation, and expanded auto-opposing force applications for more realistic training against live adversaries. These developments are critical as Cybercom continues to face an unprecedentedly complex and scaling global cyber threat landscape, demanding constant innovation in training and operational readiness. #cybersecurity #uscybercommand #pcte #militarytraining #cyberwarfare #cyberthreats #multidomain #simulation #cyberdefense #cyberoperations Source- https://lnkd.in/gW3aFUWA

🌐 A new CELR platform is set to strengthen U.S. seaports' cyber defenses, protecting against potential cyberattacks and ensuring smooth port operations >> https://hubs.la/Q02M8HFz0 The newly developed Control Environment Laboratory Resource (CELR) platform by the Science and Technology Directorate (S&T) and the Cybersecurity and Infrastructure Security Agency (CISA) aims to enhance the cyber resilience of U.S. harbors. "When CISA mentioned that the USCG’s Cyber Protection Team (CPT) identified the need to develop new training and testing tools for our seaports, we got right to work with subject matter experts (SMEs) in this field to build and implement a state-of-the-art seaport CELR platform." - S&T Program Manager, Eileen Rubin. #shipping #technology #cybersecurity DHS Science and Technology Directorate

Enhancing Transportation Cybersecurity and Fleet Management for the DoD Tenable’s latest blog post highlights the urgency of enhancing cybersecurity and fleet management for the Department of Defense. With a focus on Operational Technology security, there is a need for advanced solutions to combat cyber threats and ensure national security. Tenable’s innovative approach includes automated asset inventory and real-time threat detection, aiming for a zero-trust operational environment.

Find out how a cyber resilient KVM system protects mission-critical IT systems in control centres, industrial, government and military facilities from threats in a digital world. Protect your systems against cyber attacks through IHSE KVM systems. #cybersecurity #missioncritical #datatheft #cyberattack #dataprotection

Security Operations Centers (SOCs) stand as the first line of defence against an ever-evolving array of #cyber threats. But amidst the escalating complexity of cyber-attacks, how can you ensure your #SOC remains resilient? Inspired by a workshop presented by Patrick Butler of Tesserent | Cyber Solutions by Thales at the recent Australian Information Security Association (AISA) Cyber Conference in Canberra, here is a recommended approach:     🔐Threat Actor Insight: Start by meticulously compiling a comprehensive list of potential threat actors. Understanding their tactics, techniques, and procedures (TTPs) is key to anticipating and thwarting their moves. 🔐Reverse Engineering: Armed with invaluable insights into potential threats, it's time to flip the script! Reverse engineer your log sources and requests to align with identified threat profiles. This proactive approach empowers you to anticipate and pre-empt attacks before they materialize. 🔐Automation Integration: To truly fortify your SOC, embrace automation across the board. Seamlessly integrate critical technologies such as Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), and Extended Detection and Response (XDR). Automating mundane tasks liberates your analysts to focus on critical threat hunting and response efforts. #SOC #threatintelligence #automation #resilience #SIEM #SOAR #XDR

The U.S. Army’s Program Executive Office for Enterprise Information Systems (PEO EIS) is working to consolidate and centralize the service’s cyber defense capabilities. Individual programs have largely been operating in “siloes of excellence,” according to PEO EIS Chief Information Security Officer (CISO) Ali Mohammed, with individual programs doing their own thing. Through what the office is calling a Neighborhood Watch pilot program, EIS plans to remove barriers and collapse cybersecurity programs into a converged cyber defense capability on both unclassified and classified networks. EIS has more than 26 Security Information and Event Management (SIEM) capabilities that it wants to consolidate into one new SIEM solution. “Each program has stood up its own capabilities and has innovative techniques and ways they’ve approached cyber defense,” said PEO EIS Chief Information Officer Michael Chappell. “We want to be able to create an agile, standardized baseline and share cyber defense innovations across PEO EIS….” The goal, he added, is to have a “shoulder to shoulder, force-multiplying cyber defense capability across the Army, starting here — and now — within EIS.” Full article: https://lnkd.in/egMZYEWp #USArmySignalCorps #Signalcorps #USARMY @US_CYBERCOM @ARCYBER @armyfutures @Signal_School @US_CYBERCOM