Noel Nazario

CISA has published a draft of the new CISA SBOM Minimum Elements! The 2021 NTIA Minimum Elements were an important step to help create a common specification of what should be in an SBOM. CISA is proposing an updated, clarified version that can be aligned with existing tools and support use cases. They are actively seeking feedback, so please share, review, and send them your thoughts! https://lnkd.in/eRm_zxT2

201

13 Comments

CISA has effectively shuttered its Stakeholder Engagement Division (SED)—eliminating teams responsible for critical infrastructure, industry, and international partnerships. It's a wake-up call for the private sector. These cuts "create a dangerous void" and weaken the government’s ability to interact with the private sector on vital cybersecurity issues. The writing is on the wall for critical infrastructure operators: you cannot rely on shrinking federal resources. The government is signaling that you are, increasingly, on your own. It’s time for every organization protecting essential services to become fiercely proactive and self-reliant. This means elevating your security posture and, crucially, actively participating in your sector's Information Sharing and Analysis Center (ISAC). Collaboration with peers is now your most reliable defense. There's an ISAC for every sector, find yours here: https://lnkd.in/eSeq46YZ

177

11 Comments

The addition of the Govern function in NIST CSF 2.0 addresses the rise of risk management and governance as an essential task for IT and security teams. While it has existed in previous versions, this elevation to a core function places it in a position of necessary prominence for any organization looking to proactively assess, mitigate, and transfer their cyber risk through risk-driven cybersecurity strategies.

12

Cybersecurity is a Whole-of-Nation Challenge — And States Can’t Go It Alone This week’s Congressional hearing made one thing crystal clear: the State and Local Cybersecurity Grant Program (SLCGP) isn’t just a budget line—it’s a frontline defense. Experts like Utah’s Alan Fuller and Connecticut’s Mark Raymond didn’t mince words: SLCGP is a cost-effective engine for cyber readiness, enabling under-resourced municipalities to protect the systems we all rely on—water, healthcare, public safety. In a threat landscape where ransomware attacks doubled between 2018 and 2024, this program isn’t optional. It’s operationally essential. But the message wasn’t just about money—it was about mission. This grant enables a “whole-of-state” model that unites state and local actors, sharing intelligence and establishing clear cyber roles before—not after—incidents happen. Let’s not lose the plot in budget debates. Preventing a breach is cheaper, safer, and smarter than recovering from one. Investing upstream in cyber hygiene, training, and detection is national security, not just local spending. Read more at: https://lnkd.in/e-95QDFV

27

1 Comment

𝗧𝗵𝗲 𝗗𝗼𝗗 𝗜𝘀 𝗢𝘃𝗲𝗿𝗵𝗮𝘂𝗹𝗶𝗻𝗴 𝗜𝘁𝘀 𝗥𝗶𝘀𝗸 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸 Last week's RFI from the US Department of Defense marks the beginning of its "blow up" of its current Risk Management Framework (RMF). 𝗪𝗵𝗮𝘁'𝘀 𝘁𝗵𝗲 𝗶𝘀𝘀𝘂𝗲? The RMF (as it stands) is slow, redundant, and overly compliance-driven. It burdens cyber and acquisition teams with overwhelming amounts of paperwork and static checklists, often producing risk outputs that obscure actual mission readiness. 𝗜𝗻 𝘀𝗵𝗼𝗿𝘁: It's a dated framework built for an obsolete era in which software deployments don't happen weekly and adversaries don't exploit zero-day vulnerabilities at an industrial scale. 𝗪𝗵𝘆 𝗻𝗼𝘄? The operational environment has shifted and is continuing to do so at a dramatic pace. The volume of vulnerabilities is skyrocketing, threat actors are faster and more adaptive and mission systems, especially those built on modern DevSecOps pipelines, require near real-time visibility into cyber risk. 𝗜𝗻 𝘀𝗵𝗼𝗿𝘁: The current RMF isn't keeping up, and the toll that this is taking has become too much for leadership to bear. 𝗪𝗵𝗮𝘁'𝘀 𝘁𝗵𝗲 𝗽𝗹𝗮𝗻? The DoD is exploring a much-needed streamlined approach with fewer control redundancies, greater automation, and continuous security assessments embedded in the software development lifecycle. Rather than certifying systems and solutions at a single point in time, the new approach would rely on control inheritance, platform security baselines, and threat-informed updates. 𝗜𝗻 𝘀𝗵𝗼𝗿𝘁: Adopt an assessment approach that's designed from the beginning to reduce overhead and move faster. 𝗧𝗵𝗲 𝗯𝗲𝗻𝗲𝗳𝗶𝘁𝘀? - More timely insights into rapidly evolving cyber risks - Fewer bottlenecks for innovation and implementation - Better alignment between security assurance and operational needs 𝗧𝗵𝗲 𝘂𝗹𝘁𝗶𝗺𝗮𝘁𝗲 𝗴𝗼𝗮𝗹: Help commanders understand how cyber risks could directly impact mission readiness and operational outcomes. 𝗕𝗿𝗼𝗮𝗱𝗲𝗿 𝘀𝗼𝗰𝗶𝗲𝘁𝗮𝗹 𝗶𝗺𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀? This shift isn't only about the DoD. It signals a more widespread truth for any organization that needs to manage cyber risk at scale (so, nearly all entities). Nowadays, we need frameworks and assessment processes that can reflect the swiftly evolving cyber risk landscape. Static approaches won't cut it. Stakeholders need real-time visibility and credible, contextualized quantification that helps them make decisions based on impact. That's the future the DoD is trying to build: an environment where cyber risk is continuously assessed and directly tied to business outcomes. 𝘐𝘵'𝘴 𝘵𝘩𝘦 𝘴𝘢𝘮𝘦 𝘧𝘶𝘵𝘶𝘳𝘦 𝘵𝘩𝘢𝘵 𝘮𝘰𝘥𝘦𝘳𝘯, 𝘰𝘯-𝘥𝘦𝘮𝘢𝘯𝘥 𝘤𝘺𝘣𝘦𝘳 𝘳𝘪𝘴𝘬 𝘱𝘭𝘢𝘵𝘧𝘰𝘳𝘮𝘴 𝘢𝘳𝘦 𝘦𝘯𝘢𝘣𝘭𝘪𝘯𝘨. https://lnkd.in/dGCPWgd6 

27

4 Comments