Latest / CMMC Compliance Guide / Ceasefire’s Here, But Your Shop’s Still a Target: What the DoD CIO Just Told Defense Contractors

Transcript

Ceasefire’s Here, But Your Shop’s Still a Target: What the DoD CIO Just Told Defense Contractors · CMMC Compliance Guide

• 0:21
  SPEAKER_00: Hey there, welcome to CMMC Compliance Guide Podcast.
• 0:24
  SPEAKER_00: I'm Stacey.
• 0:25
  SPEAKER_01: And I'm Austin.
• 0:27
  SPEAKER_00: From Justice IT Consulting, where we help businesses like yours navigate CMMC and NIST 800-171 compliance.
• 0:33
  SPEAKER_00: We're hired guns getting companies fast-tracked to compliance, but today we're here to give you all the secrets for free.
• 0:39
  SPEAKER_00: So if you want to tackle it yourself, you're equipped to do so.
• 0:42
  SPEAKER_00: Let's dive into today's episode and keep your business on track.
• 0:46
  SPEAKER_00: Today's episode is one of the most important ones we've done thus far.
• 0:50
  SPEAKER_00: Because even though the headlines say ceasefire between Israel and Iran, the cyber war, that's still live.
• 0:57
  SPEAKER_00: Right after the ceasefire was announced, Katie Arrington shared an urgent memo from the DOD CIO.
• 1:03
  SPEAKER_01: It basically said this, that every defense contractor, regardless of your size, so, and it specifically said that in the memo, that this is for small contractors, mid-sized contractors as well, not just the Lockheeds and Raytheons, Boeings of the world, that you need to raise your cyber defenses and need to do it now.
• 1:22
  SPEAKER_00: So let's kind of dive into what's really going on.
• 1:25
  SPEAKER_00: Why did the DOD feel the need to make this public statement right now?
• 1:29
  SPEAKER_01: It's a good question.
• 1:30
  SPEAKER_01: I mean, you know, we just saw a ceasefire announced and it seems to be being held to currently, at least when we're recording this.
• 1:40
  SPEAKER_01: Who knows when this gets released what happens.
• 1:43
  SPEAKER_01: But, you know, it's because geopolitics don't stop at a ceasefire.
• 1:47
  SPEAKER_01: A cyber war is often conducted without the scrutiny of the press.
• 1:51
  SPEAKER_01: So that's the one benefit these nation states have and they see in cyberspace is that you don't have a bunch of reporters or running around you know, reporting on things or people with their smartphone recording it, you know, get reports on X or Twitter, you know, those don't happen.
• 2:12
  SPEAKER_01: So they can be conducted without scrutiny and people directly being aware of it or being reported on.
• 2:21
  SPEAKER_01: And the US, especially in this memo, has taken a clear stance that its adversaries and their cyber proxies.
• 2:30
  SPEAKER_01: So a lot of times, The cyber wars are conducted through other groups or entities, not from the nations directly, much like normal or happens that they're already targeting the defense industrial base.
• 2:49
  SPEAKER_01: You know, this doesn't have this.
• 2:50
  SPEAKER_01: This happens on.
• 2:52
  SPEAKER_01: you know, a normal basis, but especially in times of conflict, especially as large as this one, it really ramps up even after the ceasefires.
• 3:02
  SPEAKER_01: So, yeah.
• 3:04
  SPEAKER_01: You know, it's not just the primes, not just the big guys.
• 3:09
  SPEAKER_01: Like I said earlier, this memo is focusing on that the Department of Defense wants to be on high alert.
• 3:14
  SPEAKER_01: They specifically mentioned and called out, you can go read it.
• 3:18
  SPEAKER_01: We'll include the link to it in the video description and in the podcast description so you read it for yourself.
• 3:25
  SPEAKER_01: But they specifically call out the smaller entities as well, not just the primes.
• 3:32
  SPEAKER_01: So if your shop, your manufacturer makes parts for weapon systems, aircraft, you know, a wire harness or assembly harness or something, and ends up, you know, with Lockheed, Raytheon, Boeing.
• 3:48
  SPEAKER_01: Chances are you're a target.
• 3:50
  SPEAKER_01: And that's why the DOD CIO laid out in black and white in that memo.
• 3:54
  SPEAKER_01: But the NIST SP special publication 800-171 is the minimum requirement.
• 4:00
  SPEAKER_01: If you handle CUI, you need to be compliant now.
• 4:03
  SPEAKER_01: Not next year.
• 4:04
  SPEAKER_01: Not when CMMC becomes a contract clause.
• 4:07
  SPEAKER_01: Don't get mad at me.
• 4:08
  SPEAKER_01: This is the Department of Defense saying it.
• 4:10
  SPEAKER_00: Getting into the meat and potatoes of all this, what are the actual steps the DOD is telling us to take?
• 4:16
  SPEAKER_01: Yeah, so the memo...
• 4:18
  SPEAKER_01: Actually, breaks it out pretty simply into about four buckets.
• 4:23
  SPEAKER_01: The first is reducing the risk of getting hacked.
• 4:27
  SPEAKER_01: That's the first kind of directive to the defense industrial base.
• 4:31
  SPEAKER_01: And they specifically call out, make sure you've turned on multi-factor authentication.
• 4:36
  SPEAKER_01: And news alert, if you didn't know, that was part of the controls already.
• 4:42
  SPEAKER_01: So you're already supposed to have turned that on.
• 4:45
  SPEAKER_01: Multi-factor authentication, especially as far as the defense department is concerned, They want to make sure that you've turned it on for remote access, access across the network, and then for admin and privileged logins as well.
• 5:03
  SPEAKER_01: So they also called out making sure that you patch your systems.
• 5:08
  SPEAKER_01: So that means anything from your computers to your firewalls, your switches, stuff like that.
• 5:16
  SPEAKER_01: And it specifically called out that you need to focus on the known exploited vulnerabilities list from CISA.
• 5:23
  SPEAKER_01: Again, that's another URL that we'll include on the description here.
• 5:28
  SPEAKER_01: So you can go actually do that.
• 5:31
  SPEAKER_01: So another part of that first bucket of reducing the risk of getting hacked is shutting down unused ports and services.
• 5:39
  SPEAKER_01: We're not a big fan of opening ports or services at all.
• 5:42
  SPEAKER_01: It's hard to make them secure.
• 5:44
  SPEAKER_01: So we recommend and not doing that as much as possible.
• 5:49
  SPEAKER_01: And if you have to do it, you have to do it in a very secure way.
• 5:52
  SPEAKER_01: So if you've got, you know, I think a lot of people out there are probably guilty of having like a remote access port or something open, you need to shut that bad boy.
• 6:04
  SPEAKER_01: especially in times of high alert, but you really should design a secure solution around it long term.
• 6:09
  SPEAKER_01: But they call that specifically shutting down those unused ports and services.
• 6:14
  SPEAKER_01: The other is following CISA's cloud security guidance.
• 6:17
  SPEAKER_01: It's gonna be in the description as well.
• 6:19
  SPEAKER_01: Basically, if you're using Microsoft 365, Azure Web Services, really any cloud service provider like that, You need to follow that guidance to basically harden it, lock it down.
• 6:34
  SPEAKER_01: I'll actually read out the actual verbiage, which is a production or operational tenant as a cloud service provider environment used by the government to conduct official government business, whether operated by the government or a contractor.
• 6:50
  SPEAKER_01: So that last piece or a contractor means that you are conducting official government business in their eyes.
• 6:58
  SPEAKER_01: So if you're using Microsoft 365, Azure Web Services, any cloud service provider, and you're basically, you know, the way to think about it would be if you're using it for COI or any contract information, that cloud service that you have then needs to be hardened according to that CISA cloud security guidance.
• 7:20
  SPEAKER_01: So you need to go do that too.
• 7:23
  SPEAKER_01: They also mentioned in the memo to check out the free resources from the CISA Cyber Hygiene.
• 7:32
  SPEAKER_01: Again, another link we'll have below.
• 7:34
  SPEAKER_01: NSA's Cyber Collaboration Center, another link we'll have below.
• 7:39
  SPEAKER_01: And then DC3's DC ISE portal as well.
• 7:47
  SPEAKER_01: Another link we'll have below.
• 7:48
  SPEAKER_01: But basically, those are three free resources that the Department of Defense provides to their government agencies and their contractors of the defense industrial base to help secure their networks and whatnot.
• 8:06
  SPEAKER_01: So you can also go find someone commercially to do those things for you.
• 8:12
  SPEAKER_01: you know, uh, if you're not a fan of using their resources, but they do provide some free resources, um, unless some don't cost a dime, just, you know, some, some initiative and some labor hours there.
• 8:24
  SPEAKER_01: Uh, that's all the first bucket.
• 8:26
  SPEAKER_01: So, uh, the second bucket would be work on detecting threats early.
• 8:31
  SPEAKER_01: Um, that would first and foremost mean turn on, uh, monitoring of system logs.
• 8:38
  SPEAKER_01: Now, um, A lot of people probably won't like that I'm going to say this, but basically the way we see it here at CMMC Compliance Guide is that the compliance standards basically mandate you have a security SIM, in our opinion, without actually mandating it.
• 8:59
  SPEAKER_01: It says all the things that a SIM basically does.
• 9:02
  SPEAKER_01: And it's easier just, in our opinion, to buy that off the shelf and then assuming that it's compliant and fits all the compliance boxes.
• 9:12
  SPEAKER_01: But go purchase a SIM and implement it.
• 9:16
  SPEAKER_01: So that way, you can properly go through all those logs, protect them, and review them as needed because otherwise, You have to go into all the different locations and review them in their...
• 9:37
  SPEAKER_01: their source, which is not easy to do if you're familiar with IT logs and security logs.
• 9:45
  SPEAKER_01: The Assem collects it all for you.
• 9:47
  SPEAKER_01: And then it also satisfies some of the other controls like protecting it.
• 9:52
  SPEAKER_01: The logs, you're supposed to keep them from being deleted and whatnot.
• 9:55
  SPEAKER_01: So we recommend Assem.
• 9:59
  SPEAKER_01: The memo doesn't say that.
• 10:00
  SPEAKER_01: We recommend it, but the memo says that you need to turn on and monitor your system logs.
• 10:04
  SPEAKER_01: So if anything were to happen, You can go look at those and figure out what happened, or they might be able to give you advance notice of something happening on your network and you'd be able to shut it down before it gets too far gone.
• 10:20
  SPEAKER_01: The second part of detecting threats early would be to use antivirus and important.
• 10:29
  SPEAKER_01: update the antivirus with the signatures of the new viruses coming out.
• 10:33
  SPEAKER_01: So they specifically say, make sure that you're doing that.
• 10:36
  SPEAKER_01: So I hope that everyone's doing that.
• 10:38
  SPEAKER_01: That's been a, most people know you need an antivirus for a long time.
• 10:43
  SPEAKER_01: So I really hope that everyone out there listening is doing it, has one, but you know, another, it sounds like simple fundamental stuff, but you know, you have antivirus and you think that the the patches and updates are being applied just automatically and you haven't checked it you're probably wrong um and i i don't say that to be uh controversial other than the fact that whenever we go into new networks that like we manage and stuff typically uh the backups they think they're being completed aren't being completed the antivirus updates that they think are being done aren't being done or half the workstations are out of date.
• 11:27
  SPEAKER_01: And it goes on.
• 11:28
  SPEAKER_01: So it's not good enough just having it installed.
• 11:32
  SPEAKER_01: You need to make sure that the updates are actually applying and working and nothing's broken there.
• 11:39
  SPEAKER_01: So another piece of detecting the threats early, the memo says, is to review access controls for any third party vendors or partners, basically.
• 11:49
  SPEAKER_01: And so The idea there being that you don't want to be exploited through their access means, right?
• 12:01
  SPEAKER_01: So check those.
• 12:04
  SPEAKER_01: And if your vendor is doing anything on your behalf or on your network or whatever it may be, don't just assume that they're doing things securely.
• 12:13
  SPEAKER_01: For example, I know that whenever I walk into a doctor's office that I can, I can spot 10 HIPAA violations whenever I go in there for my appointment.
• 12:25
  SPEAKER_01: You know, it's just because they're a doctor's office, they don't assume that they're following the HIPAA guidelines, right?
• 12:31
  SPEAKER_01: Same for your vendors, you know, just cause you've hired them and they do a good job.
• 12:34
  SPEAKER_01: You know, you may love your doctor, but it doesn't mean that they're actually you know, securing your data, um, or your network the way that they should be.
• 12:44
  SPEAKER_01: So you need to ask those hard questions.
• 12:45
  SPEAKER_01: It doesn't mean, you know, maybe that you need to fire them, but, um, ask the questions that way they can do it and protect yourself.
• 12:53
  SPEAKER_01: Right.
• 12:55
  SPEAKER_01: The third bucket, um, is be ready for an incident.
• 12:59
  SPEAKER_01: So, um, you know, that may sound, um, rather easy or like, oh yeah, sure, we're ready.
• 13:08
  SPEAKER_01: If something hits a fan, then I'll call my IT guy or something.
• 13:13
  SPEAKER_01: But it's actually a lot harder than that.
• 13:15
  SPEAKER_01: And if you've ever been on the receiving side of a breach or remediating a breach, you realize how important an incident response plan is.
• 13:28
  SPEAKER_01: whenever you need it.
• 13:29
  SPEAKER_01: So for example, if someone gets ransomwared, um, you know, whether the it guy, uh, or your company is there and answering the phone or not, um, you know, it is one thing.
• 13:40
  SPEAKER_01: Um, but what the actual pre-planned directives are, you know, sitting in what roles, you know, so do you need to contact your lawyer?
• 13:50
  SPEAKER_01: What communication needs to go out to customers or your employees?
• 13:54
  SPEAKER_01: What's the decision process for leadership?
• 13:56
  SPEAKER_01: Do you need to, um, work with your cyber insurance provider.
• 14:03
  SPEAKER_01: You know, on that specifically, a lot of times they require a lot of things from you.
• 14:10
  SPEAKER_01: And if you if you veer off of what their required track is, you don't get coverage.
• 14:16
  SPEAKER_01: So you really need, that's just an example, but you really need to think through all these things before it happens, because chances are you're gonna miss it in the storm of everything.
• 14:26
  SPEAKER_01: And it's specifically mentioned in the memo that you need to have an incident response plan pre-planned, and then it'd be a good idea if you tested it as well, make sure that things go right.
• 14:39
  SPEAKER_01: And again, News alert to anyone that doesn't know, but all the controls require for you to have a plan in place for that already.
• 14:48
  SPEAKER_01: So bucket number four would be recovering from an attack, which would be making sure you're able to recover from an attack, rather.
• 15:02
  SPEAKER_01: First, it mentions to test your backups.
• 15:05
  SPEAKER_01: Again, I mentioned earlier, just because you have the backups turned on doesn't mean they're working.
• 15:10
  SPEAKER_01: Most of the times when we come in to a new environment and that hadn't been checked on a regular basis, they're not working or some portion of them aren't or they're corrupted.
• 15:20
  SPEAKER_01: So you really need to test them because things happen, especially with technology.
• 15:27
  SPEAKER_01: And then second to that is make sure that they're isolated.
• 15:31
  SPEAKER_01: So the reason for that is is that if your company gets hacked and the backups are on the same network that's hacked, then hackers know and even just the malware and viruses that are coded know to go look for backups.
• 15:50
  SPEAKER_01: So it doesn't even require a person doing it.
• 15:52
  SPEAKER_01: A lot of times they go look for backups and they'll go delete them or they'll extract them and pull them elsewhere.
• 15:59
  SPEAKER_01: But they know to look for that because you know, the ability to recover from a backup really undermines the person that's attacking you, right?
• 16:12
  SPEAKER_01: So that is specifically looked for during a breach.
• 16:17
  SPEAKER_01: The other part of recovering from an attack is that if you're on operational technology, Most of you guys are, unless you're just a full on digital firm, everything's digital.
• 16:29
  SPEAKER_01: Manufacturers are all running operational tech.
• 16:33
  SPEAKER_01: So think your CNC machines, all your PLC cards, all of that stuff is operational technology.
• 16:40
  SPEAKER_01: And so the memo, calls out in there to conduct a test of manual controls to ensure that the critical functions remain operational.
• 16:51
  SPEAKER_01: If your organization's network is unavailable, hacked, ransomwared, down or otherwise, you know, untrusted.
• 16:58
  SPEAKER_01: So if you have to disconnect the operational tech from the network, you need a plan to be able to still run your shop floor, right?
• 17:07
  SPEAKER_01: So even if your network goes down, you still need to ship parts.
• 17:10
  SPEAKER_01: That's part of the resilience that the Defense Department is trying to build in their supply chain.
• 17:16
  SPEAKER_00: So let's tie all of that together.
• 17:19
  SPEAKER_00: Austin, can you explain why this is just more than a heads up?
• 17:23
  SPEAKER_01: You know, it's because the Department of Defense is not just sending out memos just to look busy and stuff like that.
• 17:31
  SPEAKER_01: So they're signaling...
• 17:35
  SPEAKER_01: you know, what's coming next.
• 17:36
  SPEAKER_01: So there, there is actually a concern at the defense department at the department of defense, um, that there's a heightened concern, um, for cyber threats.
• 17:53
  SPEAKER_01: So that's the reason they're doing it.
• 17:54
  SPEAKER_01: They wouldn't be doing it otherwise.
• 17:56
  SPEAKER_01: I mean, they, they've already been saying, um, very often how important CMMC is and how much you need to comply.
• 18:05
  SPEAKER_01: I mean, it's been going on for years.
• 18:08
  SPEAKER_01: The fact that this memo is coming out on top of the ceasefire and kind of everything that's going on in terms of the geopolitical stuff in the world right now, it's very intentional because it's something they're actively concerned about.
• 18:23
  SPEAKER_01: This basically means that even with the ceasefire, you should assume that since they put this memo out, that the cyber attacks are increasing.
• 18:31
  SPEAKER_01: The war in cyberspace is always on, and the digital attacks that happen in cyberspace support the kinetic ones like the bombs dropping in the real world.
• 18:41
  SPEAKER_01: And when the ceasefire is happening, the cyberspace war is supplemental to it.
• 18:46
  SPEAKER_00: So to tie everything together, Austin, what should a listener do this week in accordance to all of these news, the memos, and what's happening in the news right now?
• 18:55
  SPEAKER_01: If we're thinking about the average small to mid-sized contractor, aerospace, defense manufacturer out there, really it all comes back to is the controls that your contracts say you have to comply with, right?
• 19:12
  SPEAKER_01: So the cybersecurity controls specifically is what we're talking about.
• 19:16
  SPEAKER_01: So, and...
• 19:18
  SPEAKER_01: All the memo is saying, although very importantly and very urgently, is that you really need to make sure that you're doing those things.
• 19:28
  SPEAKER_01: So we like to use your SPRS score, SPURS score, as basically a starting point to determine where you are on the path for controls, right?
• 19:45
  SPEAKER_01: So, because that's what it's there for, right?
• 19:48
  SPEAKER_01: So if you're a contractor out there, you don't really know where to start, go look at what your Spurs score says, what you said your Spurs score is, and then ask yourself whether or not that's actually true, right?
• 20:02
  SPEAKER_01: So start there.
• 20:03
  SPEAKER_01: And if it's not 110, you know, which is a perfect score or close to it, like actually 110 and not, one that you're just kind of hope and prayer putting in there, then you need to get that score up, right?
• 20:21
  SPEAKER_01: So, and do all those things the controls are saying.
• 20:26
  SPEAKER_01: Second would be to go review your multi-factor authentication.
• 20:30
  SPEAKER_01: Again, that's remote access, that's access across the network, and then your MFA for privileged accounts or administrative accounts.
• 20:41
  SPEAKER_01: Then go check your backups.
• 20:44
  SPEAKER_01: Make sure that they're actually completing.
• 20:45
  SPEAKER_01: Maybe that you actually have backups first and then that they're actually completing correctly and then test them.
• 20:51
  SPEAKER_01: Make sure that you can restore from a backup, open a file or something like that.
• 20:57
  SPEAKER_01: Make sure it actually works.
• 20:58
  SPEAKER_01: Then check your patches.
• 21:00
  SPEAKER_01: Basically, are your firewalls up to date with the latest firmware?
• 21:05
  SPEAKER_01: Are your computers up to date with the latest Windows or Adobe updates?
• 21:11
  SPEAKER_01: Are your switches up to date?
• 21:13
  SPEAKER_01: Anything that runs software on your network needs to be up to date with the latest, at least security patches.
• 21:19
  SPEAKER_01: And if you're not up to snuff on your SPRS core yet, They're quick wins that help protect yourself.
• 21:26
  SPEAKER_01: So, you know, you can really, you can cover your butt a little bit from getting hacked and being forced to let the Department of Defense know that you're not doing what you're supposed to be doing.
• 21:35
  SPEAKER_01: Now, we don't condone that, but we know people out there are in that boat.
• 21:40
  SPEAKER_01: So if you're looking to really mitigate risk here, that's the first place to start.
• 21:46
  SPEAKER_01: And then it would be going and implementing all the controls and doing what you're supposed to be doing.
• 21:52
  SPEAKER_01: Another thing to do would be to use the CISA's cyber hygiene tools.
• 21:58
  SPEAKER_01: They're free out there.
• 21:59
  SPEAKER_01: The Department of Defense provides them for you for the purpose of securing the supply chain.
• 22:04
  SPEAKER_01: Or you could use commercial platforms that are important or compliant.
• 22:10
  SPEAKER_01: that can do the same thing.
• 22:11
  SPEAKER_01: Another thing to do would be to schedule a response drill.
• 22:17
  SPEAKER_01: So make sure that your incident response plan actually works and makes sense through a mock disaster or hack or breach, that your backups actually work.
• 22:30
  SPEAKER_01: And if this is all over your head and seems very overwhelming, call somebody, get help.
• 22:37
  SPEAKER_00: At note, if you're having trouble figuring all of this out, we're actually offering a free SPRS roadmap session.
• 22:44
  SPEAKER_00: So you can check that out in the description below.
• 22:46
  SPEAKER_00: It can give you clarity on where you stand and what to fix first.
• 22:50
  SPEAKER_00: So in that session, we'll walk you through your current SPRS standing, a plain English summary of your gaps, and also a clear roadmap to hit 110 so you can stay defensible.
• 23:02
  SPEAKER_00: Most importantly, in the description below as well, we will link to the memo.
• 23:06
  SPEAKER_00: So if you really want to go back and read that for yourself, you can do so.
• 23:10
  SPEAKER_00: And we'll also put in the description those resources that Austin mentioned previously as well.
• 23:16
  SPEAKER_00: So you'll have access to all of those great stuff.
• 23:19
  SPEAKER_00: If you have any questions about what we covered, reach out to us.
• 23:22
  SPEAKER_00: We're here to help fast track your compliance journey.
• 23:24
  SPEAKER_00: Text, email, or call in your questions and we'll answer them for free here on the podcast.
• 23:31
  SPEAKER_00: You can find our contact info at cmmccomplianceguide.com.
• 23:37
  SPEAKER_00: Stay tuned for our next episode.
• 23:39
  SPEAKER_00: Until then, stay compliant and stay secure.
• 23:42
  SPEAKER_00: Like, subscribe, and share.