Insights | MatrossEdwards

govconjudicata

cyberjudicata

Click either link to visit external blogsites

Apr 1
1 min

Joshua Duvall Successfully Recertifies as a CISSP

We are pleased to announce that managing partner Joshua Duvall successfully fulfilled the requirements by (ISC)² to recertify as a Certified Information Systems Security Professional ("CISSP"), a certification that Mr. Duvall has held since 2018. The CISSP designation is a vendor-neutral cyber credential that confirms technical knowledge and experience to design, implement, and manage the overall information security and risk posture of an organization. Typically required by

Matross Edwards

Mar 16
1 min

Joshua Duvall to Participate in CMMC Panel Discussion for CMMC Information Institute

On Friday, March 19, 2021, Joshua Duvall will participate in a panel discussion, Cybersecurity, CMMC, and the Law: What Every Contractor Needs to Know, hosted by the nonprofit CMMC Information Institute. Joined by Kate Growley of Crowell & Morning LLP and Robert Metzger of Rogers Joseph O'Donnell PC, the panel will cover a host of issues related to the Department of Defense's new cyber regime, including: My prime contractor keeps asking me about CUI. What is CUI, how do I id

Matross Edwards

Jan 26
1 min

Joshua Duvall to Participate in NVSBC Panel Discussion on CMMC and Defense Contracting

On Thursday, January 28, 2021, Joshua Duvall will participate in a panel discussion covering the Department of Defense's ("DoD") Cybersecurity Maturity Model Certification ("CMMC"). The event, hosted by the National Veteran Small Business Coalition Central Florida Chapter, is the second installment in the CMMC Panel Discussion series. The CMMC Panel Discussion 2.0 will cover a host of issues related to the CMMC including, the rollout timeline, maturity level requirements, cos

Matross Edwards

Nov 12, 2020
1 min

Joshua Duvall to Present on CMMC Panel at DoD/Intel Industry Event

On Tuesday, December 1, 2020, Joshua Duvall will participate in a panel discussion, "CMMC and Impact to Defense Contractors" at The 5th Annual Doing Business With DOD & The Intel Community virtual conference. Moderated by Jenny Clark from Solvability and joined by industry experts Bhavesh Vadhani from CohnReznick and John Weiler from the CMMC Center of Excellence, the panelists will explore the Department of Defense's upcoming Cybersecurity Maturity Model Certification ("CMMC

Joshua Duvall

Nov 4, 2020
1 min

GovConJudicata Podcast #5 – A Conversation: NIST SP 800-171 DoD Assessments and CMMC

This GovConJudicata Podcast is a replay of A Conversation: NIST SP 800-171 DoD Assessments and CMMC* with Alicia Lynch, VP & CISO, SAIC and Jennifer Short, Partner, KaiserDillon. During our conversation, we provide a high-level overview of DoD's new two-pronged cyber rule (effective November 30, 2020) and discuss various business, cyber, and legal issues that defense contractors need to consider as they endeavor to comply with the requirements under this new rule. *Originall

Joshua Duvall

Oct 7, 2020
3 min

Cyber Math: A Note on NIST SP 800-171 DoD Assessment Scoring

Last week, the Department of Defense ("DoD") published its long-awaited rule on its Cybersecurity Maturity Model Certification ("CMMC") framework. Notably, in addition to the CMMC framework, the rule also includes a second framework related to NIST SP 800-171 DoD Assessments that some defense contractors will also need to consider. This second prong of DoD's cyber regime adds another layer of complexity for defense contractors with an obligation under the Defense Federal Acqu

Matross Edwards

Sep 25, 2020
1 min

Joshua Duvall to Participate on Upcoming CMMC Panel Discussion for the NVSBC

On September 30, 2020, Joshua Duvall will participate in a panel discussion covering the Department of Defense's ("DoD") Cybersecurity Maturity Model Certification ("CMMC") for the National Veteran Small Business Coalition. Joined by other cyber industry leaders and experts, the panel will discuss the latest and greatest CMMC initiatives, requirements, and concerns. Some of the questions the panel will address are: When are businesses supposed to be CMMC compliant/certified b

Matross Edwards

Sep 9, 2020
2 min

President Signs New Space Policy Directive

On September 4, 2020, President Trump signed Space Policy Directive-5 (SPD-5), which establishes a set of cybersecurity principles designed to protect the nation's valuable "space systems" from a host of cyber threats aimed at disrupting our Nations critical infrastructure. As defined in SPD-5, "space systems" is a "combination of systems, to include ground systems, sensor networks, and one or more space vehicles, that provides a space-based service. A space system typically

Joshua Duvall

May 26, 2020
2 min

Verizon 2020 Data Breach Investigations Report

The Verizon 2020 Data Breach Investigations Report ("DBIR") is here. In this 13th DBIR, Verizon analyzed a record total of 157,525 incidents, of which 32,002 met their quality standards and 3,950 were confirmed data breaches. Before we dive into some the data, here are some helpful definitions: Threat actor: Who is behind the event? This could be the external “bad guy” that launches a phishing campaign or an employee who leaves sensitive documents in their seat-back pocket.

Joshua Duvall

May 11, 2020
3 min

Ready. Set. Cybersecurity. (CMMC ML 1 & Small Business Resources)

For some small businesses, securing your information systems (and your proprietary data) might seem complicated and expensive, but it doesn't have to be. After all, cybersecurity can simply be described as implementing practices, procedures, and technologies to protect the confidentiality, integrity, and availability of data (i.e., to help prevent unauthorized access to data and cyberattacks). A cybersecurity program can begin with, for example, creating information security

Matross Edwards

Apr 17, 2020
2 min

GAO Report: DoD Needs to Improve Cyber Hygiene

This week, the Government Accountability Office ("GAO") published a report finding that the Department of Defense ("DoD") has "not fully implemented three of its key initiatives and practices aimed at improving cyber hygiene." GAO conducted this study, in part, because DoD has become "increasingly reliant on information technology (IT) and risks have increased as cybersecurity threats evolve." GAO found that some 90% of cyberattacks could be avoided or defeated through basic

Matross Edwards

Apr 8, 2020
2 min

CISA Issues COVID-19 Cyber Threat Update (and US-CERT Alert)

Today, the U.S. Cybersecurity and Infrastructure Security Agency ("CISA") published a joint advisory with the UK’s National Cyber Security Centre ("NCSC") in light of cybercriminals exploiting the COVID-19 pandemic by targeting individuals and organizations with a range of ransomware and malware. According to the joint advisory, some examples include scams with "emails containing malware which appear to have come from the Director-General of the World Health Organization (WHO

Matross Edwards

Mar 20, 2020
4 min

GovCon & Cyber Weekly Debrief (3/16–20)

GovConJudicata This week's Weekly Debrief covers COVID-19 and its impact on government contractors, Federal cyber policy, NIST's suggestions for securing virtual meetings, and the Pentagon's legislative proposal for the Space Force. COVID-19 NextGov – Government’s Maximum Telework Policy Overlooks Contractors "This week the Office of Management and Budget issued a memo asking federal agencies and departments to offer “maximum telework flexibilities” to eligible employees. A

Matross Edwards

Mar 20, 2020
1 min

DoD Releases CMMC Model v1.02

Today, the Department of Defense ("DoD") released Version 1.02 of its Cybersecurity Maturity Model Certification ("CMMC"), dated March 18, 2020. According to the CMMC Errata, all fifteen changes were termed "Administrative" changes (as opposed to "Substantive" or "Critical" changes). Some of the Administrative changes include, for example: In practice AT.4.059, the references to NIST SP 800-53 Rev 4 AT-2(3), AT-2(4), AT-2(6), AT-2(7) were removed. In practice CM.2.066, refe

Joshua Duvall

Feb 12, 2020
1 min

NIST Seeks Pre-Draft Comments on Supply Chain Risk Management Special Publication 800-161r1

On February 4, 2020, the National Institute of Standards and Technology ("NIST") issued a pre-draft call for comments to Special Publication 800-161r1, Supply Chain Risk Management Practices for Federal Information Systems and Organizations. Since its publication in 2015, there have been many changes in the laws, regulations, tools, and technologies related to supply chain risk management. To that end, in consistent with past updates, NIST: seeks the input of SP 800-1

Joshua Duvall

Jan 6, 2020
2 min

CISA Publishes Alert on Potential for Iranian Cyberattacks

Today, the Cyber Security and Infrastructure Security Agency ("CISA") published an alert regarding the potential for Iran to conduct cyberattacks against U.S. interests in response to the recent military strike in Baghdad. The alert is comprehensive and provides an Iranian cyber threat profile and cyber activity, recommended actions (below), and publicly known Iranian advanced persistent threat ("APT") patterns (including mitigations and detection recommendations). Al

Joshua Duvall

Jan 5, 2020
4 min

Three Thoughts: Iranian Retaliatory Cyberattack

Many of you have heard the news that President Trump ordered a drone strike that killed a top Iranian military commander, General Qasem Soleimani. So, what happens next? Well, according to news reports (e.g., here, here, here, here, and here), experts predict that Iran will likely retaliate with a series of "disruptive and destructive" cyberattacks on U.S. interests (including, business and government agencies). Given that retaliatory cyberattacks are likely (or have al

Matross Edwards

Jan 3, 2020
2 min

CyberJudicata Weekly Debrief (12/30–1/3)

Happy New Year! The first Weekly Debrief of 2020 covers a number of interesting topics, such as the Ryuk ransomware that took down a maritime facility, ransomware at IT services provider, resuscitating cyber prevention, defending against APTs, and CCPA coverage. CyberAttacks ZDNet – US Coast Guard discloses Ryuk ransomware infection at maritime facility "An infection with the Ryuk ransomware took down a maritime facility for more than 30 hours; the US Coast Guard said

Joshua Duvall

Jan 2, 2020
1 min

Worst Passwords of 2019

Yes, it's that time of year again. With news of data breaches regularly appearing in the nightly news, individuals and businesses alike should take time to revisit their password practices. Given the sometimes devastating consequences that can flow from data breach, it's shocking that "123456," "123456789," "qwerty," "password," and "1234567" are still among the worst offenders. Below are the top 25 worst passwords from SplashData's “Worst passwords of 2019” list. 1 -

Joshua Duvall

Jan 1, 2020
1 min

CyberJudicata [Re]Launch

Welcome to the [re]launch of CyberJudicata, a blog providing news, insights, and legal analysis on a variety of cybersecurity and privacy issues. CyberJudicata was previously part of GovConJudicata, a blog providing news, insights, and legal analysis to the government contracting space. To get the latest content, please follow my blogs on Twitter/Twitter and LinkedIn/LinkedIn. I'm looking forward to 2020! Josh . . . #cyberjudicata #cyber #cybersecurity