🦄 Jeff McCoy

🗣️ Our newest Zarf Tech Talk recap is live! 📹 Tech Talk: Simplifying DevSecOps in Air-Gapped Environments with Zarf, brought together experts from Sonatype, Defense Unicorns, and Boeing to break down one of the biggest challenges in secure software delivery: operating in disconnected or restricted environments. Whether you're working in regulated sectors or simply want a more predictable, secure supply chain, this talk is packed with practical lessons. 📺 Watch the recording: https://lnkd.in/e_fNNeQB 📝 Read the full recap: https://lnkd.in/eTukHgMx 📄 Access the slides: https://lnkd.in/eVXkygZS Thanks to our moderator ⚙️ Eddie Knight and speakers Brandt Keller, Kit Patella, and Daniel Miller! 🙏 #Zarf #DevSecOps #OpenSSF #TechTalk #OSSSecurity

25

𝗕𝗮𝗰𝗸 𝘁𝗼 𝗺𝘆 𝗙𝗼𝘂𝗿 𝗠𝗼𝘂𝗻𝘁𝗮𝗶𝗻𝘀: 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝗺𝗲𝗻𝘁𝘀, 𝗰𝗼𝗻𝘁𝗿𝗮𝗰𝘁, 𝗳𝘂𝗻𝗱𝗶𝗻𝗴, 𝗮𝗻𝗱 𝗽𝗿𝗶𝗼𝗿𝗶𝘁𝘆.  Companies often associate user problems, wants, or needs with requirements. Just because a user has a problem does not mean they have a requirement. Let's talk about the first mountain. Requirements. 𝗣𝗿𝗼𝗯𝗹𝗲𝗺𝘀 𝘃𝘀 𝗥𝗲𝗾𝘂𝗶𝗿𝗲𝗺𝗲𝗻𝘁𝘀. In DoD acquisition, they are not the same thing. For a problem to become a requirement, the operational unit (or someone) has to document it properly. Here is a simple example of a (fictional) scenario where a unit may turn a problem into a requirement that leads to a potential purchase of a solution. An Army unit is typically tasked with seizing an airfield as a core objective. On this mission, they are also tasked with establishing a tactical air traffic control center. Mission analysis reveals they are trained and ready for the airfield seizure. The USAF sends trained people and a communication package. Everything is good, almost. What they cannot do is airdrop a comms package. The gear is not configured with a parachute that works on a C-130. That is a problem. In acquisition language, maybe we'd call it a gap. It is the difference between the assigned task and the current capability to accomplish the task. An abbreviated capabilities-based assessment might look like: - Define the mission: Seize airfield, set up an air traffic control - Assess current capability: Capable of airfield seizure - Identify the gap: No parachute system to airdrop comms package - Analyze solutions: Modify the mission, borrow equipment, buy something new - Recommend a way forward: Buy a parachute system for the comms  The output could be nothing more than a 9-line that describes the gap, the mission impact, and some possible solutions. They might even specify a vendor or product. One way or another, 9 line, JCIDS, or whatever, it's written down and approved at some higher level. 𝗡𝗼𝘁𝗶𝗰𝗲 𝘄𝗵𝗮𝘁 𝗱𝗶𝗱 𝗻𝗼𝘁 𝗵𝗮𝗽𝗽𝗲𝗻. At no time did the unit have to talk to a vendor, attend a trade show, or watch a demonstration. They just analyzed the mission, took a look at what they were capable of, and wrote that down. Key point: If users do not document, the acquisition system will probably never fix it for them. Once approved in whatever process is available to them, the signed document becomes the requirement. Focus there. That is the Requirement. 𝗛𝗼𝗺𝗲𝘄𝗼𝗿𝗸 𝘁𝗼 𝗰𝗼𝗻𝘀𝘂𝗹𝘁𝗮𝗻𝘁𝘀: Track, maybe even influence this step. Know if the government is following its own process. Teach them if you have to, and then follow the requirements process until fully approved. Final note: Ethics are key. Every step you take should protect your government partner from an ethical dilemma. One step toward putting them in a bad spot is one step toward putting yourself at a disadvantage.

45

4 Comments

Frontdoor is compiling a resource on the new tools to find customers in DoD Partial list below -- who else are we missing? - Pryzm by Nick LaRovere, Matt Hawkins and David Istrati - Obviant by Brendan Karp - Usul (YC S24) by Jarren Reid and Oliver Gomez - Sweetspot (YC S23) by Sachin S. and Philip Kung - Demand Signal by Catherine Edmonson - Deltek GovWin - GovSignals - CLEATUS AI Got use cases / success stories? Get in touch!

54

5 Comments

��� Zarf v0.65.1 has been Released 🚀 One of the most substantial features in a long time has came to alpha - The registry proxy mode. For those who know how Zarf operates today - It solves the chicken and egg problem of Deploying a registry without having a registry to pull the registry image from - all without any distro-specific requirements. But there are emerging updates to kubernetes where the current model falls short - NFTables, IPV6, etc With the registry proxy alpha - Zarf has the ability to support all distributions of Kubernetes more ubiquitously while also opening some paths to improving our security and threat model. See the release notes in the comments below.

23

3 Comments

11 new RFQs were posted on GSA MAS today, and several are strong opportunities with deadlines coming up next week. One that stands out is the Network Engineers and Specialists Support RFQ with DoD. Looks pretty easy to respond to. Here’s the thing. many vendors skip RFQs with short deadlines because they assume the requirement is “wired.” But that’s not how it works. As a Co/CS If I wanted to direct a requirement to a specific vendor, I’d use a different path: raise the ceiling on an existing contract, route it through an ANC or 8(a), or place it under a BPA. If it’s being openly competed on GSA MAS, then it’s fair game. These types of solicitations often only receive one or two proposals—making them excellent opportunities for those willing to act quickly.

12

1 Comment

𝗨𝗦𝗦𝗢𝗖𝗢𝗠 𝗶𝘀 𝗹𝗼𝗼𝗸𝗶𝗻𝗴 𝗳𝗼𝗿 𝘄𝗮𝘆𝘀 𝘁𝗼 𝗿𝗲𝗱𝘂𝗰𝗲 𝘁𝗶𝗺𝗲, 𝗰𝗼𝘀𝘁, 𝗮𝗻𝗱 𝗺𝗮𝗻𝗽𝗼𝘄𝗲𝗿 𝗶𝗻 𝗶𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲 𝘀𝘂𝗿𝘃𝗲𝘆𝘀, 𝗮𝗻𝗱 𝘁𝗵𝗲𝘆’𝗿𝗲 𝗻𝗼𝘁 𝘀𝘁𝗮𝗿𝘁𝗶𝗻𝗴 𝘄𝗶𝘁𝗵 𝗮𝗻 𝗥𝗙𝗣. SOFWERX, in collaboration with SOCOM J2, is hosting an  𝗔𝘂𝘁𝗼𝗻𝗼𝗺𝗼𝘂𝘀 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻𝘀 𝗖𝗼𝗹𝗹𝗮𝗯𝗼𝗿𝗮𝘁𝗶𝗼𝗻 𝗘𝘃𝗲𝗻𝘁 𝘁𝗼 𝗲𝘅𝗽𝗹𝗼𝗿𝗲 𝗔𝗜-𝗲𝗻𝗮𝗯𝗹𝗲𝗱 𝗮𝗽𝗽𝗿𝗼𝗮𝗰𝗵𝗲𝘀 for mapping, route collection, and data exploitation tied to real-world operations. The government is inviting industry, academia, and non-traditional vendors into the conversation. Warfighters will engage directly with potential solution providers to clarify operational needs and constraints. They’re specifically exploring solutions that can: • Use AI to extract doors, windows, and wall geometry from structural blueprints (AutoCAD) • Automate route collection across complex urban terrain • Map buildings and compounds without existing data • Rapidly capture imagery of office buildings This event is a good opportunity for teams building AI, autonomy, geospatial, or analytics capabilities with an interest in USSOCOM missions. This is also an opportunity for attendees to meet and form partnerships that may provide a more comprehensive solution, according to the agency's expectations. 📅 31 March 2026 (Request to attend by March 3) 📍 In person at SOFWERX 🔗 SAM notice link: https://lnkd.in/eP4xpW_H #GovCon #SOFWERX #USSOCOM #DefenseInnovation #AI #Autonomy #FederalIT #OTA

15

Any builders making cloud platforms in Gov/GovCon, be prepared for the flood of “how much time/money/effort will it take for you to move out of Azure?” questions. FWIW, building in Azure made/makes a lot of sense, because DoD/USG is in deep with Azure, so connecting makes things easier, plus everyone on the gov side is pretty familiar with an Azure stack. Now we have to start dealing with the “yeah…but now we want out” conversations…

12

21 Comments

Small prime contractors competing for DoD and IC contracts face a critical advantage hiding in plain sight: Veterans with active security clearances, military technical training, and mission understanding. The challenge isn't veteran capability it's that small primes with 1-5 recruiters lack the specialized veteran recruiting infrastructure that large primes build with 50+ person teams. 𝗩𝗲𝘁𝗲𝗿𝗮𝗻𝘀 𝘀𝗼𝗹𝘃𝗲 𝗺𝘂𝗹𝘁𝗶𝗽𝗹𝗲 𝘀𝗺𝗮𝗹𝗹 𝗽𝗿𝗶𝗺𝗲 𝗽𝗮𝗶𝗻 𝗽𝗼𝗶𝗻𝘁𝘀 𝘀𝗶𝗺𝘂𝗹𝘁𝗮𝗻𝗲𝗼𝘂𝘀𝗹𝘆: They arrive with security clearances (eliminating 12-18 month sponsorship waits), understand DoD/IC mission requirements, bring proven technical skills, and help small primes meet 5% SDVOSB federal subcontracting goals. The small primes winning OASIS+ and SeaPort NxG task orders build veteran talent pipelines through partnerships with firms maintaining direct military base relationships, dedicated veteran recruiters, and upskilling programs translating military experience to cleared contractor roles. Veterans served the mission. Smart small primes build the recruiting infrastructure to hire them. 𝗔𝗰𝗰𝗲𝘀𝘀 𝗢𝘂𝗿 𝗩𝗲𝘁𝗲𝗿𝗮𝗻 𝗧𝗮𝗹𝗲𝗻𝘁 𝗣𝗶𝗽𝗲𝗹𝗶𝗻𝗲 Link: https://lnkd.in/gDNd5qe4 #VeteranHiring #ClearedTalent #PrimeContractors #SDVOSB #MilitaryTransition #SecurityClearance #OASISPlus #SeaPortNxG #DoD #FederalContracting

14

1 Comment

A new survey from MITRE says that a majority of non-traditional defense contractors face barriers of inflexibility and complexity in the acquisition process. As DoD tries to bring more innovation and flexibility into its stable of contractors, what really needs to change to make this possible? Keoki Jackson of MITRE joined the Federal Drive with Terry Gerton to share more about the survey's results. https://lnkd.in/dFXpvB8G

41

1 Comment

🚨 GSA is Sending Out “Exclusion Determination Letters” for MAS Contractors 🚨 As promised, GSA is reaching out to vendors who are non-compliant with I-FSS-639 Contract Sales Criteria—letting them know their contract will not be included in the option period. These exclusions were delayed during COVID, but that grace period is over. 🛑 Don't let your GSA MAS contract slip away without a fight. Here’s what you can do: 1️⃣ Address non-compliance head-on. 🔹 How: Review your sales history and identify shortfalls. Respond to GSA with a plan showing how you'll meet minimum sales — such as pricing adjustments, bundling strategies, or leveraging subcontracting opportunities. 2️⃣ Show your BD strategy. 🔹 How: Submit pipeline reports, BD outreach logs, or capability briefs. Show GSA that you’re actively marketing your contract and pursuing federal opportunities via SAM.gov, eBuy, or teaming arrangements. 3️⃣ Share additional support/resources. 🔹 How: Highlight investments you’ve made — such as hiring consultants, working with capture firms, launching marketing campaigns, or enhancing your proposal support — to improve visibility and increase your win probability (PWin). Here's something else to consider: 🔍 CODY AI – GSA’s new tool to accelerate vendor vetting. Kris Brinker recently shared insights on how it might impact your standing. 👉 Check it out here https://lnkd.in/edB73Y72 Stay sharp, stay compliant and seek help if needed. #GSASchedule #GovCon #BDStrategy #Compliance #CODYAI #FederalContracting #MAS

53

6 Comments

FIPS 140-3 is not the only cryptographic standard for Federal.... *gasp* really Rob?! There's tons of guidance and multiple NIST SPs to sort through. Frankly it's just overwhelming for most engineers to comb through all the guidance and make a determination on what to use or how to configure a library. Now imagine trying to align standards across FedRAMP, U.S. Department of Defense, Commercial, and EU. This is an area where there's lots of guidance, and little alignment. So it's up to us practitioners to merge this and basically advise engineering teams on what to do. No company wants to have to follow 4 or more different standards. Just for current Federal requirements, here are a few standards you should track. - SP 800‑131A Transitioning the Use of Cryptographic Algorithms and Key Lengths - SP 800‑57 Pt.1 Rev.5 Recommendation for Key Management: Part 1 – General - SP 800‑175B Rev.1 Guideline for Using Cryptographic Standards in the Federal Government: Cryptographic Mechanisms - FIPS 186‑5 Digital Signature Standard (DSS) - SP 800‑208 Recommendation for Stateful Hash-Based Signature Schemes - FIPS 180‑4 (upd1) Secure Hash Standard (SHS) - FIPS 203, 204, 205 all the new PQC SPs - SP 800‑90A Rev.1, 90B, 56A/56B/56C Rev.2, 800‑135A - SP 800‑38 series (AEAD: GCM; storage: XTS‑AES; key wrap: KW/KWP) - SP 800‑52 Rev.2 (TLS), SP 800‑77 Rev.1 (IPsec/IKE), NISTIR 7966 (SSH) For commercial, you may add in a few more - Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates Version 2.7.1 (August 25, 2025) CA Browser Forum, Server Cert WG - Baseline Requirements for the Issuance and Management of Publicly‐Trusted Code Signing Certificates Version 3.9.0 (August 1, 2024) CA Browser Forum, Code Signing Cert WG For Department of Defense, mTLS, PIV/CAC/Smartcart, Identity Authentication.. here's some more - DOD INSTRUCTION 8520.02 PUBLIC KEY INFRASTRUCTURE AND PUBLIC KEY ENABLING - DOD INSTRUCTION 8520.03 IDENTITY AUTHENTICATION FOR INFORMATION SYSTEMS European Standards - EUCC Guidelines Cryptography v2 If you're planning your Post Quantum Crypto journey there's a few notable standards you should look at. - CNSA 2.0 - FIPS 203, 204, 205 Moral of the story? NIST and DOD need to distill this down into one guide for engineers to follow and for organizations to adopt as a cryptographic standard. This needs a whole lot of KISS. *Note: I know I'm missing many more from numerous countries. If I missed any DOD or Federal standards, feel free to comment 😅 #Security #PostQuantumCrypto #KISS

19

3 Comments

👀 Recruiters in the Cleared GovCon Space (or just in general), Here’s What’s Working for Me. Quick disclaimer: these aren’t “the best 3 things out there.” But they are 3 things I’ve noticed that make a massive difference when the market feels tough and candidates are harder to come by. 1️⃣ Consistent Outreach Not just when you have a hot req. Daily touchpoints, steady LinkedIn activity, and follow-ups compound over time. Consistency builds trust and keeps you top of mind. 2️⃣ Personalized Outreach Templates are fine as a baseline, but nothing beats taking 60 extra seconds to connect the role to someone’s background. People can spot “copy-paste” a mile away. Personal touches = higher response rates. 3️⃣ Play the Numbers Game Recruiting is math. The more outreach, the more conversations. The more conversations, the more submissions. The more submissions, the more hires. Don’t get discouraged when the ratio feels off — keep pushing volume and let the numbers work in your favor. At Metronome, we see daily that this market is versatile and competitive. Staying disciplined on these 3 points has helped me big time. 💬 Curious to hear from my fellow recruiters — what’s one thing you’ve been doing consistently that’s moving the needle? Ricky Derring II Chase Valentine Sean Goody Stephanie Holman, M.Ed Allie Smith 🇺🇸 Janine Chafee Brooke Weinert Virgil Virga Cristian Cuadras

29

18 Comments

A few weeks ago I praised Perplexity’s Comet browser as a game changer — marking the beginning of the end for browsing (and browsers) as we knew them. One didn’t need to be the Oracle of Delphi to see it coming. Now comes ChatGPT’s Atlas agentic browser — not just a tool for searching, but for thinking, reasoning, and acting across the web. You no longer open tabs; you delegate outcomes. If Comet made exploration frictionless, Atlas makes it intent-driven. The browser is no longer a window — it’s a co-pilot. More to come on this front as surely big tech will unlikely stay put watching nimble players in the space take significant market hold. Disclaimer: The views expressed here are solely my own and do not necessarily represent, nor should they be construed to represent, those of NATO or the NATO Communications and Information https://flip.it/3if2j_

7

1 Comment

Ready or not, CMMC 2.0 Level 2 is here—and the numbers might surprise you. This new co-authored report from Kiteworks and Coalfire surveyed 209 organizations in the Defense Industrial Base (DIB) and uncovered some eye-opening stats: 1️⃣ 41% have completed a formal gap analysis—but those that do are far more likely to have fully documented cybersecurity policies (73% vs. 28% for those who haven’t started). 2️⃣ Organizations with robust documentation are 30 times less likely to report inconsistent encryption of controlled unclassified information (CUI). 3️⃣ A big disconnect? 54% of cybersecurity leaders say their documentation is fully in place, but 80% of CEOs believe everything is covered. 4️⃣ Medium-sized firms lead the way in hiring experienced partners (50%), underscoring the value of external expertise in achieving compliance. 5️⃣ Whether you’re a smaller shop grappling with technical complexity or a large enterprise ironing out scope definitions, these insights reveal best practices and common pitfalls on the path to CMMC success. 👉 Read the report: https://gag.gl/tTx2MP #CMMC #Cybersecurity

31

1 Comment

NASA Engineer on agile in DoD: “I’ve worked at NASA and now on a complex DoD system-of-systems program... I’ve seen some programs swing so hard away from process that ‘agile’ just means doing whatever the customer wants, whenever they want it. That leads to constant scope changes and chaos. How do you navigate that?” One of the best questions from our recent webinar came from someone who’s worked across both NASA and DoD programs. 100% agree with the problem. Agile is one of the most misunderstood terms in engineering. People throw it around too loosely. Too often, it’s interpreted as: - “Just break the Gantt chart into sprints” - “No plan, just build” - “Everyone’s in charge, all the time” That’s not agility. That’s drift. What actually matters is how you burn down risk and deliver outcomes. Implementation—the guardrails—is everything. The best teams: 1. Anchor to clear top-level goals 2. Work bottom-up to figure out what they can build, fast 3. Use just enough process to move quickly and stay aligned Call it structured iteration. Call it outcome-driven engineering. Whatever the name, it’s not about rejecting process. It’s about using it intentionally . The real job is to give teams the autonomy to build creatively, and the structure to stay aligned. That’s what responsible engineering looks like. Whether the execution looks agile, waterfall, or somewhere in between.

463

35 Comments

Fail of Fame: ClearanceJobs.com 1. CSP set to “Please Hack Me” default-src * blob: data: 'unsafe-inline' 'unsafe-eval' • This is the CSP equivalent of leaving your front door open with a neon “WELCOME” sign. • Allows any script from anywhere, runs any inline code, and even executes arbitrary strings with eval(). • Impact: Any XSS bug instantly becomes full account compromise, data theft, or drive-by malware. No browser-side safety net at all. 2. CORS Misconfiguration From Hell Access-Control-Allow-Origin: *.clearancejobs.com + Access-Control-Allow-Credentials: true • Wildcard origins aren’t valid with credentials — browsers should ignore it, but backend logic could still misapply it. • If improperly enforced server-side, this could let a malicious subdomain read authenticated API responses. • Impact: Potential data leakage of personal info, resumes, or job activity from logged-in users. 3. Permissions-Policy? Referrer-Policy? COOP/CORP? Nope. • Zero modern isolation headers to reduce the blast radius of a compromise. • Impact: Easy clickjacking, over-sharing of referral data, and no site isolation to contain injected code. 4. Audience Risk Profile Off the Charts • The user base isn’t random shoppers — it’s people with active or pending security clearances, working in defense, intel, and government. • Impact: An XSS or session theft here isn’t just personal inconvenience — it’s an espionage goldmine. 5. CloudFront Popcorn Machine • Sitting behind AWS CloudFront, so an attacker only needs one injection point in any origin server to serve malicious code globally in minutes. • Impact: Massive scale, instant reach, global compromise in one hit. 6. No Defense in Depth • No content isolation, no sandboxing, no enforced HTTPS beyond HSTS, and no selective resource loading. • Impact: Everything depends on backend code being flawless — and backend code is never flawless. Translation: Right now, any competent attacker who finds a small injection or misconfig on ClearanceJobs.com could: • Steal logins and personal data from people with active clearances. • Pivot to spear-phishing campaigns targeting high-value individuals. • Potentially harvest sensitive employment history that could be used for foreign intelligence targeting. Source:

22

11 Comments

"If you want to do business with the federal government, specifically the DoD, do you want to bank on another company getting FedRAMP authorized in time? We’re not adding to our tech stack unless it’s CMMC compliant. This is the path forward. Our adversaries are trying to infiltrate our systems daily. If they’re not FedRAMP authorized, and you want to work with the DoD—run.”   That’s what one contractor shared during the ENR-hosted webinar on CMMC compliance.   Like many federal contractors, they assumed their compliance strategy was solid, until they realized the risk wasn’t just internal. Their entire ecosystem, from partners to vendors, had gaps that could cost them contracts.   That’s the reality of CMMC.   It’s not just another checkbox. It’s the new baseline for doing business with the DoD, and it’s already impacting revenue.   In this panel discussion, sponsored by Kahua, industry experts from Quanta Government Solutions, AVCOR CONSTRUCTION, LLC, Aprio, and K2, Inc. break down how they’re tackling this challenge. From aligning internal teams to guiding subs, they’re sharing what’s working and what’s not in real time.   Watch the full session to learn: ✅ How leading contractors are turning compliance into a competitive edge ✅ What it takes to build a scalable, cross-team compliance framework ✅ Common blind spots and lessons learned from the field ✅ Why choosing a FedRAMP-authorized platform like Kahua matters ✅ A quick demo of Kahua’s free CMMC Readiness app to help you get organized   Watch the full webinar now, link in the comments.

26

1 Comment