Al Sowers

DISA Expands Thunderdome Zero Trust Program Deployment; Brian Hermann, Quoted. ExecutiveGov discusses the Defense Information Systems Agency's (DISA) expansion of the Thunderdome zero trust program. In 2023, the program was deployed to 15 sites and plans are underway to extend it to 60 more sites in 2024. The program involves four key components: 🔐 Customer security stacks 🔗 Software-defined wide area networking 📴 Secure access service edge capability, and 💯 Application security stacks. Brian Hermann, DISA's director of the cybersecurity and analytics directorate, emphasized the program's role in advancing zero trust architecture, which is crucial for organizational security. DISA has also finalized the contracting process to support the U.S. Coast Guard’s network security improvement efforts through Thunderdome. Versa Networks is at the forefront of enhancing cybersecurity with their pivotal role in DISA's Thunderdome project. Their cutting-edge solutions are setting new standards in securing our nation's digital infrastructure. For more details, you can read the full article here:-https://lnkd.in/dYX76H8s #DISA #Thunderdome #ZeroTrust #Cybersecurity #versanetworks #channelpartners

2

Vendor Provided Containers - Part 4 The "Vendor Dependency Conundrum". So you do FedRAMP or DOD/IL* work and you have a POAM (Plan of Action and Milestones). For the folks who don't do Public Sector work, this is basically a list of all of your compliance violations and vulnerabilities. What happens when you have a vulnerability in a vendor provided container? Specifically for something the vendor doesn't produce or patch? Often companies will make this a "Vendor Dependency". A "Vendor Dependency" is basically saying, "we'll wait until the upstream vendor patches it". But lets be real for a moment. The choice to use the "Vendor Provided Container" is yours and yours alone. Making it a vendor dependency is passing the responsibility for something that is most definitely the responsibility of the Cloud Service Provider (the authorized service). I described in my previous posts how vendor provided containers are woefully inadequate for production use (not hardened, not stripped, missing FIPS, etc). Long story short, the burden is still on the Cloud Service Provider (or consumer of those containers) to do all of the above. So while vendor provided containers are good to get started, they shouldn't be anywhere near a production environment. Going forward we need vendors to move past creating "development" containers, because that's really all they're good for. We need a standard for containers coming from vendors and if vendors are truly pursuing their CISA pledge of Secure by Design, they would harden them and strip them according to best practices. If they want to make it easy for DOD/FedRAMP customers, they would STIG harden them, and provide them with valid FIPS libraries. In summary, don't use vendor provided containers. You need to build your own or work with a vendor that builds and hardens container images as a service. Building your own images has a real cost to it too. It's also a discipline to do it fast and do it well. Teams are not usually equipped to take this on and often haphazardly do this work.

19

𝗕𝗼𝗹𝗱 𝗽𝗿𝗲𝗱𝗶𝗰𝘁𝗶𝗼𝗻 𝘁𝗶𝗺𝗲: 𝗖𝗠𝗠𝗖 𝗿𝘂𝗹𝗲𝗺𝗮𝗸𝗶𝗻𝗴 𝗲𝗱𝗶𝘁𝗶𝗼𝗻 - 𝗧𝗵𝗲 𝟯𝟮 𝗖𝗙𝗥 𝗖𝗠𝗠𝗖 𝗳𝗶𝗻𝗮𝗹 𝗿𝘂𝗹𝗲 𝘄𝗶𝗹𝗹 𝗯𝗲 𝗽𝘂𝗯𝗹𝗶𝘀𝗵𝗲𝗱 𝗯𝘆 𝘁𝗵𝗲 𝗲𝗻𝗱 𝗼𝗳 𝟮𝟬𝟮𝟰 - 𝗧𝗵𝗲 𝟰𝟴 𝗖𝗙𝗥 𝗖𝗠𝗠𝗖 𝗳𝗶𝗻𝗮𝗹 𝗿𝘂𝗹𝗲 𝘄𝗶𝗹𝗹 𝗯𝗲 𝗽𝘂𝗯𝗹𝗶𝘀𝗵𝗲𝗱 𝗮𝘁 𝘁𝗵𝗲 𝗲𝗻𝗱 𝗼𝗳 𝟮𝟬𝟮𝟱 This matters because DoD's "phased roll-out" for CMMC in contracts starts with the 48 CFR final rule revising DFARS clause 252.204-7021 to match the program details codified by the 32 CFR CMMC final rule. However, once the CMMC program is live thanks to the 32 CFR final rule, all bets are off: anyone can pay for an official CMMC assessment at that point. This means that the "market roll-out" will start long before DoD contractually requires anyone to have a certification and there's nothing DoD can really do about it. The most recent DFARS open cases report shows that the 48 CFR rule is bouncing around for revisions inside DoD which will add tons of time to before it's published even as a proposed rule. Competition and prime contractor questionnaires will drive a stampede of companies desperate for certification assessments while DoD scribbles away.

77

13 Comments

Really great summary of best practices for container hardening.

5

https://lnkd.in/gw2mqQqa Huntsville Business Journal FYI https://lnkd.in/gpFCdTeW I own the TM Huntsville AI, please take down this article. HSV.Ai doesn't have the right to Huntsville AI. They are legally obligated to use Huntsville AI LLC.