FBI Investigating HHS Cyberattack

FBI Investigating HHS Cyberattack
FBI Investigating HHS Cyberattack

The FBI Investigating HHS Cyberattack During Coronavirus Crisis

The AP reported that Attorney General William Barr has announced that the FBI is investigating the HHS Cyberattack that took place on March 16, 2020 for the involvement of foreign governments.  The incident that was originally reported on Sunday March 16, 2020 by Bloomberg, involved a cyberattack on the Department of Health and Human Services (HHS).  The attack attempted to launch disruptive information and impede the agency’s response.  Fortunately, the attempt failed to penetrate the network.  The HHS  was continually monitoring the infrastructure and detected a significant increase in activity.

Government Cybersecurity Preparedness

Government agencies are attractive targets for cyberattacks.  In 2018 President Trump signed into law the creation of the Cybersecurity and Infrastructure Security Agency to bolster the government’s capacity to defend against cyberattacks.  The HHS along with other agencies have been slow to implement improvements to its IT infrastructure.  The Government Accountability Office report issued in February of 2020 states that all but two federal agencies had failed to “effectively monitor the implementation of a voluntary cybersecurity framework”.  The HHS was among those criticized.  The agency did however replace its cybersecurity operation with the HHS-DHS Health Cybersecurity Coordination Center.  It may well be because of this change that this crisis was averted.

Health Industry Preparedness

The HHS published Health Industry Cybersecurity Practices (HICP) to move health providers towards effective practices to protect important and sensitive data.  This information is provided in two volumes, one for small health care organizations and another for medium to large providers.  This effort is well designed but its implementation is difficult to assess.  This is due to the fact that there is no mandate for companies to their information to the government.  Based on a general survey of business cyber preparedness most U.S. companies are not ready to protect critically sensitive data.

CVG Strategy Cybersecurity

CVG Strategy cybersecurity experts are committed to helping businesses attain effective cybersecurity programs.  We can help you implement ISO 27001 Information Security Management Systems to develop a scalable solution to protect your valuable data.  Contact Us today to see how we can help

Concerns for Business Cybersecurity Capabilities

Concerns for Business Cybersecurity
Concerns for Business Cybersecurity

Business Cybersecurity Report Card for 2019

There are growing concerns for business cybersecurity to meet the challenges of today’s hostile environment.  The international insurance underwriter Hiscox recently released its Hiscox Cyber Readiness Report 2019 and the news was not good.  The report showed that the number of cyber attacks has increased and that businesses of all sizes are being targeted.  While cybersecurity spending has increased fewer companies have attained appropriate levels of cyber strategy and execution.  The report included findings from companies located in Belgium, France, Germany, The Netherlands, Spain, United Kingdom, and the United States.

Trends in Cyber Attacks

Increases in the number of organizations reporting incidents of cyber attacks have occurred over the past year.  While larger businesses are more likely to experience these attacks, large increases in rates among medium and small size firms have occurred.  Reported losses from these attacks have increased by over dramatically, but the true value of damage done from loss or compromise of sensitive data is impossible to truly assess.  While cybersecurity spending has increased by as much as 24%, the number of firms rated as having adequate cyber strategy and execution has fallen.

Particular Concerns for Business Cybersecurity

Supply Chain Vulnerabilities

Large numbers of companies reported incidents involving their supply chain in the last year.  A majority of these organizations now recognize these vulnerabilities and are including cyber Key Point Indicators (KPI) in their contracts with suppliers.  Other efforts included increased audit and evaluation of their supply chain.

Cloud Vulnerabilities

There was a marked increase in cloud vulnerabilities in the last year with 22% of respondents reporting outages from third-party cloud providers.  This is a 9% increase from the previous year.  This increase is likely due to more firms using cloud based solutions for sensitive data.

Costs of Losses

The mean losses from cyber attacks to businesses has risen as much as 61% in the last year.  These losses were seen in all businesses regardless of size or sector.  The greatest increases were seen in large businesses with between 250 and 999 employees.

Cyber Maturity

Overall progress in attaining effective cybersecurity programs has stalled out even though increases in cybersecurity spending have occurred.  Of those who participated in the survey, 74% fell in to the Novice classification.  This assessment included strategy, oversight, resourcing, technology, and processes.  Of special concern, the United States ranked among the lowest in this category.

Some Take Aways

Businesses are beginning to take notice and are becoming less complacent.  Many are being prompted by increased regulation from governments and those companies they supply goods and services to.  Cybersecurity is an interdependent undertaking.  For an fully effective program an Information Security Management System (ISMS) should be employed.  A good example is ISO/IEC 27001.  It employs a comprehensive that includes processes, people, and IT systems to maintain data security.  Because it uses a constant improvement model, it can remain adaptable to changing threats through a risk management approach.

CVG Strategy

CVG Strategy shares your concerns for business cybersecurity.  We are committed to helping businesses secure their vital data.  CVG Strategy can establish ISO 27001 and NIST 8001-171 programs that incorporate security architecture, detective controls, and preventative controls.  We provide training so that a cooperative and coordinated effort can be made by all involved.  We are also committed to helping those who provide serviced and goods the the U.S. Department of Defense in achieving requirements for Cybersecurity Maturity Model Certification (CMMC).  Contact Us to see how we can help.

Effective Test Program Management for Better Products

effective product test management
effective product test management

Effective Test Program Management Requires Planning

Effective Test Program Management can add value to product development when its true value has been identified.  Too often product testing is left to the last moment, calls are made to test laboratories to ask what testing is required.  Equipment and somebody from the engineering team is transported off to a test lab and money and time is spent.  Hopefully testing is “passed” and requirements have been met to sell the product, but what has really been accomplished?

The Role of the Test Lab

Test Laboratories offer valuable services.  As such, finding a lab that can fill your requirements, provide flexible scheduling, and help keep the project in budget is important.  Maintaining good working relationships with those facilities is important.

The role of the lab, however, is by definition limited.  As an accredited third party evaluator they cannot act as an advocate for your product.  They can recommend a test matrix or provide a minimum criteria for product certification but ultimate responsibility for what testing is done lays with the test program manager.  Recommendations for testing should be reviewed in detail however as in many instances unnecessary testing may be performed. 

The Role of the Test Program Manager

Assessing Test Requirements

Developing a thorough understanding of relevant standards and compliance requirements is the responsibility of the test program manager.  Understanding the procedures to be performed will allow for proper scheduling.  It will also help in the development of appropriate fixtures, simulation equipment, and monitoring equipment.

Looking Beyond Compliance

Because product liability is becoming an increasing issue, product testing must consider testing beyond compliance requirements.  Performing a Life Cycle Environmental Profile and/or Susceptibility Analysis can be valuable in identifying product vulnerabilities.  A test matrix can then be created that includes appropriate evaluation methodologies to verify a design’s safety and ability to maintain customer satisfaction.

Test Program Documentation

Test Labs are beset with requests to perform testing without sufficient documentation.  While many types of testing are not tailorable, most standards still require documentation that provides descriptions of operational modes, power requirements, emergency shutdown procedures, and definitions of normal operation.  This documentation allows test lab personnel to make evaluations based on pass/fail criteria specific to the equipment being tested.  For those test methodologies that do require tailoring such as MIL-STD-810 or EN 61326-1:2013 test plans must be developed that specify procedures, severities, and appropriate data collection.

Hardware for Testing

Time must be taken to design and construct the equipment needed for test.  This equipment may include:

  • Vibration Fixtures
  • Extension Cables
  • Simulation Equipment
  • Stimulation Equipment
  • Monitoring Equipment
  • Dummy Loads

Care should be taken to consider test lab chamber and facility limitations when designing this equipment.  Simulation, stimulation, and monitoring equipment are extremely important in capturing intermittent failures.  This equipment is also required for pretest, during test, and post test functional and operational checks. 

Many people will have the test lab provide a vibration fixture.  Test lab fixtures are often in a constant state of modification as customers drill holes for their tests.  This means that even if the same piece of hardware is available at subsequent tests it will not be the same as when used before.  This may degrade the ability to accurately recreate previous testing.  Therefore it is considered a best practice to have a custom fixture.

Test Witnessing

Effective test program management requires active test witnessing.  Care must be taken to ensure that testing is performed as prescribed in the test plan.  Proper set up and pre-test operational testing should confirm that the equipment under test is working and functional.  Test witnesses can often assist lab personnel by monitoring equipment and confirming the status of the equipment.  Test witnesses should also collect data over and beyond that required by the lab so that test can accurately be reproduced.  Should any failure of test be encountered, the test witness should gather all data relevant for later analysis.  The witness should also, when appropriate, troubleshoot and determine root causes for failures.

Documentation

Documentation of testing should be created from test witness gathered data and test lab reports into a summary document that provides an overview that can be used to show due diligence and act as a guide for future product development in term of “lessons learned.  Any certifications or right to mark with regard to compliance testing should be noted as well.

CVG Strategy

CVG Strategy’s Test and Evaluation experts offer Test Program Management and Witnessing to assist you in getting real value from your testing program.  Contact Us to see how we can put decades of experience in commercial and defense testing to work for you.  Our experience includes climatic, dynamic, and EMI/EMC.

Collaboration and Quality Management, Working Together

collaboration and quality management
collaboration and quality management

 

Collaboration and Quality Management

Collaboration and Quality Management are concepts that should come to mind together.  It can, however, be difficult to institute collaboration in a manufacturing or service process.  There are challenges involved in bringing all stake holders to the table and engaging them in continuing cooperation.

Working Between Departments

Interdepartmental differences in priority, culture, and mindset can create barriers to effective collaboration.  Often these differences can place departments at loggerheads.  By establishing shared goals in achieving quality, trust can be developed that can dissolve perceived differences.  This is particularly important because honest feedback is a key component of the continuous improvement process.  This improved communication can create better working relationships between departments and increase cooperation that increases overall efficiency of processes and nurtures a better work environment.

Collaboration Between Tiers

As with any business undertaking, success begins at the top.  The executive tier must be fully committed to the concepts, goals, and processes of the Quality Management System (QMS) and must actively advocate by in from all parties.  Upper management must embrace the goals of the QMS and communicate all concerns as that system develops to ensure continuous improvement.  Upper management must also communicate goals and processes to the rest of the company and implement training as these change. 

Working With Suppliers

Establishing strong relationships with trusted and qualified suppliers is an excellent way to improve a business’s competitive performance.  By sharing quality management goals with suppliers clarification of roles and expectations can be accomplished.  This clarity can work to reduce risks by maintaining long term goals and strategies.  It can also provide improvements by identifying and eliminating waste, increasing process efficiencies, and reducing lead times. 

Developing Collaborative Processes

Collaboration can be difficult to achieve.  This is especially the case in larger established organizations where perceived barriers and differentiated goals have existed for some time.  An effective QMS can actually bring people together by demonstrating viable rewards through collaborative effort.  This increase in communication and understanding will benefit the overall health of a business allow for increased growth.

CVG Strategy

CVG Strategy quality experts can help you establish and maintain an effective QMS.  We have extensive experience with ISO 9001: 2015, AS9100D, ISO 13485:2016, ISO 27001:2013 and AAR M-1003.  Our Exemplar Global Lead Auditors can provide training, develop processes, and much more.  Contact Us today to see how we can help.

 

 

MIL STD 810H Humidity Method 507.6, A Deeper Look

MIL STD 810H Humidity
MIL STD 810H Humidity

MIL STD 810H Humidity

MIL STD 810H Humidity Method 507.6 is a test method for evaluating products that are likely to be stored and/or operated in a warm, humid environment.  MIL-STD-810 Environmental Engineering Considerations and Laboratory Tests is a Department of Defense (DoD) standard for military and commercial applications.  It is a series of laboratory test method that replicate the effects of environments on products.  These methods are meant to be tailored to the specific environmental effects expected during the life cycle of the product.  This is an important consideration because there are few definable goal posts in this standard.  Tailoring is required because the environmental effects likely to be encountered on equipment designed for aircraft, for example, will be quite different from those found on a vehicle.

Effects of Humidity

The effects of humidity are often overlooked when faced with more obvious environmental stressors such as temperature, shock, and vibration, but there are numerous physical and chemical effects that humidity can take place both within and on the exterior of equipment.  For surface effects; oxidation, electrochemical breakdown of coatings, interaction with deposits of materials that produce corrosive films, and changes in friction coefficients.  Other effects include; loss of physical strength of materials, degradation of insulative properties, changes in elasticity or plasticity, and degradation of lubricants.

Humidity Testing

Humidity is an extremely complex environmental phenomena that is intricately linked with temperature.  There a limitations in what a laboratory method can reproduce and simulate.  Method 507.6 is comprised of two procedures.

  1. Induced (Storage and Transit) and Natural Cycles
  2. Aggravated

For procedure I, induced cycles of temperature and humidity are used to simulate various storage and transit scenarios where equipment is packaged or stored in environmentally uncontrolled warehouses.  The standard points out that multiple tests may be applicable for storage or transit based on the nature of those sequences and nature of packaging.  Natural cycles are intended for the testing of equipment in its intended environmental conditions.

Procedure II exposes the test item to more extreme temperature and humidity levels than those found in nature, but for shorter durations.  While this can be an advantage for early detection of design vulnerabilities, results may not accurately represent those found in nature.

Climatic Considerations

Conditions of humidity vary considerably across the globe.  MIL-HDBK-310 defines three geographical categories that are used for generation of cyclic profiles.

B1 – Constant High Humidity

This profile is representative of conditions found in heavily forested areas with little solar radiation exposure.  Geographical locations typical of this profile are Congo and Amazon Basins, the jungles of Central America, Southeast Asia (including the East Indies), the north and east coasts of Australia, the east coast of Madagascar, and the Caribbean Islands.

B2 – Cyclic High Humidity

B2 profile occurs in the same areas as B1 but is more representative of urban areas where solar radiation exposure is expected.  Solar radiation when present in the diurnal cycle creates a wider variance in temperature and humidity.

B3 – Hot-Humid

This profile is found in areas near bodies of water with high surface temperatures, specifically the Persian Gulf and Red Sea.  Testing for this extreme condition does not verify the unit under test’s ability to endure the rigors of B1 or B2.

Additional Categories

Additional categories are provided for induced environments where temperatures as high as 160 °F (66 °C) can be reached for enclosed environmental conditions where little or no cooling air is available.  These induced categories are meant to replicate various transport and storage scenarios.

Test Duration

The effects of humidity require lengthy test durations to evaluate potential degradation.  Often testing is not performed at adequate lengths to provide meaningful data.  MIL STD 810H Humidity Method 507.6 durations are shown in the table below.

Hazardous Items

MIL-STD-810 states that hazardous test items will generally require longer tests than other items to achieve a desired confidence.  The standard defines Hazardous test items as “those in which any unknown physical deterioration sustained during testing could ultimately result in damage to materiel or injury or death to personnel when the test item is used”.  It calls for double the number of cycles for hazardous items. 

Non-Hazardous Items

For Natural Cycles, generally intended for operational testing, Method 507.6 calls for 15 to 45 tewnty-four hour cycles of testing dependent on which geographical area the equipment may be used in.

Aggravated Cycles

For Aggravated testing per Procedure II, ten cycles are recommended in addition to a 24 hour conditioning period.  Again the proviso for lengthening for hazardous items is called out but no exact measure is indicated. 

MIL-STD-810 H Table 507.6 II Test Cycles (days)

The Conundrum

For humidity testing there is often more questions than answers.  Today’s defense and commercial equipment is liable to be used anywhere in the world.  Given that time and money are major concerns for most product developers, it is unlikely that resources are available for testing all climatic categories for transit, storage, and operational profiles.  While Aggravated testing is tempting due to its shortened test length it may not provide realistic findings.  Unless product specifications specify exact testing requirements difficult decisions must be made. 

CVG Strategy

CVG Strategy’s test and evaluation experts have decades of experience in environmental (climatic and dynamic) testing as well as EMI/EMC.  We offer a wide variety of services including: EZ-Test Plan Templates, Test Program Management, Test Program Witnessing, and Product Evaluation.  We also provide a two day seminar/webinar “Understanding MIL-STD-810” to help your product development team garner the most from their test and evaluation programs. Contact Us today to see how we can help.

Export Compliance Program Management for Success

Export Compliance Program Management
Export Compliance Program Management

Export Compliance Program Management

Effective export compliance program management is important for a successful business.  International trade is more prevalent than in any time in history.  Failure to comply with export laws such as the Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR) can lead to criminal penalties and imprisonment, civil penalties, and loss of ability to conduct export business. 

Success Starts at the Top

As with any successful business undertaking, an effective export compliance program must start at the top.  Management must be committed to strict adherence with export laws and regulations.  This commitment should be documented in a statement that acts as a framework for the program.  Management must also allot adequate resources to maintain and develop the program as the business evolves. 

Establishment of Processes

Success cannot be left to chance.  Effective and consistent compliance programs have documented processes for export control classification, license determination, and screening of potential customers.  Appropriate procedures should also be set up in accordance with Part 762 of the EAR.  Roles should be created with clear definitions of responsibilities for the execution of these processes.  Because laws and regulations change and businesses evolve, a consistent review of processes utilizing risk management principles should be performed to continually mitigate potential shortcomings.

Education and Training

Processes cannot be effective unless personnel is educated of their importance.  As an export violation can be the result of a phone call, email, or conversation, all parties should be cognizant of their responsibilities in maintaining export compliance.  Regular education should be conducted to refresh this knowledge and train employees in changes in regulations and internal procedures.  Understanding thousands of pages of Export Control Regulations and ITAR is challenging.  Make sure your Export Compliance Training is engaging so that people actually learn.

Auditing Your Processes

To keep your Export Compliance Program Management system at its best regular reviews should be taken to assure it is working.  These audits can monitor specific functional areas of a program or be at the corporate level.  The U.S. Department of Commerce Bureau of Industry and Security (BIS) recommends that program level audits be conducted on an annual basis.  It is a good practice to use outside auditors for these reviews for an unbiased evaluation and validation. 

Have a Plan for Corrective Actions

Processes should be in place to detect any incident that may occur.  It is important therefore to have procedures for internal and external reporting of potential noncompliance.  Internal processes should be in place to investigate these potential incidents and disciplinary policies should be established.  Employees should understand that is expected that they report these issues and that they will not be retaliated against for upholding the law.

Should noncompliance be confirmed, appropriate departments should be prepared to submit a Voluntary Self Disclosure and develop Corrective Actions to ensure that “lessons learned” will prevent such an event recurring.

CVG Strategy Can Help

CVG Strategy is a proven leader in ITAR and Export Compliance. Our specialists have managed manufacturing and distribution businesses and have worked for multi-national organizations.  CVG Strategy’s experts are not ex-government employees, they are very familiar with the needs and goals of small to medium-sized operations.  We also provide training and auditing services.   Contact us to see how we can help you establish and maintain an effective Export Compliance Program. 

Understanding CMMC Requirements for DoD Suppliers

Understanding CMMC Requirements
Understanding CMMC Requirements

Understanding CMMC Requirements History

Understanding CMMC Requirements is critical for businesses of all sizes in the defense industry.  A key to establishing effective Cybersecurity Maturity Model Certification (CMMC) is knowing what led to its development.

Executive Order 13806

In 2017 President Donald Trump signed Executive Order 13806 Assessing and Strengthening the Manufacturing and Defense Industrial Base and Supply Chain Resiliency of the United States.  This order was undertaken in a coordinated effort by a number of government agencies.  Subject matter experts identified five macro forces that that are leading to a deterioration in U.S. capabilities.  From these they determined ten risk archetypes to the Department of Defense’s (DoD) supply chain.

Risk Identification

The Macro Forces identified are:

  1. Sequestration and Uncertainty of U.S. Government Spending
  2. Decline of U.S. Manufacturing Capability and Capacity
  3. U.S. Government Business Practices
  4. Industrial Policies of Competitor Nations
  5. Diminishing U.S. Science, Technology, Engineering, and Math (STEM) and Trade Skills

The ten Risk Archetypes are:

  1. Sole Source
  2. Single Source
  3. Fragile Supplier
  4. Fragile Market
  5. Capacity Constrained Supply Market
  6. Foreign Dependency
  7. Diminishing Manufacturing Sources and Material Shortages
  8. Gap in U.S. Based Human Capital
  9. Erosion of U.S. Base Infrastructure
  10. Product Security

Recommendations

With regard to the challenges identified in its assessment, the Interagency Task Force made a number of recommendations.  Those that specifically addressed cybersecurity included:

  1. Modernization of efforts to combat Chinese intellectual property theft.
  2. Enhancing abilities to analyze, assess and monitor vulnerabilities of the industrial base.
  3. Implementation of a risk-based methodology for oversight of contractors in the National Industrial Security Program, founded on risk management framework principles to assess and counter threats to critical technologies and priority assets.
  4. Reducing the personnel security clearance backlog through more efficient processes.
  5. Further enhancing efforts to explore next generation technology for future threats.

Defense Product Cybersecurity

The defense industry supply chain is reliant on the flow of data through a vast number of networks both within and across multiple manufacturer’s systems.  Securing this data is essential for maintaining integrity, confidence, and competitive advantage.  The rapid increase in cyber-espionage aimed at the industrial sector places this data at an increased risk.  While a number of cybersecurity approaches exist in the industrial sector, most are not appropriate or adequate for the protection of controlled and uncontrolled defense information.  Key issues include:

  1. Lack of uniformity in security implementation.
  2. Inconsistent implementation by defense suppliers.
  3. Reliance on self-attestation.

CMMC is an effective means of implementing a risk based management approach that will establish baseline requirements, remain adaptive to changing cyber threats, and create a certification process.  This will allow for the integration of companies of all sizes and at all levels to maintain the resiliency and integrity of the defense manufacturing supply chain.

CVG Strategy’s Experience and Commitment

CVG Strategy is committed to the goals of CMMC in securing our defense manufacturing supply chain’s information secure.  As industry leaders in cybersecurity, ITAR, and risk based management systems.  We have experience with companies of all sizes and understand the importance of innovating flexible approaches to understanding CMMC requirements, establishing effective programs, and achieving certification.

Implementation of ISO 13485:2016 and CAPA

Implementation of ISO 13485:2016
Implementation of ISO 13485:2016
Monitors of modern medical devices

Proper Implementation of ISO 13485:2016 is Essential

Implementation of ISO 13485:2016 Quality Management System (QMS) is a requirement for manufacturers of products used for the diagnosis, prevention, and treatment of medical conditions in the U.S. market.  This requirement is established by the Food and Drug Administration (FDA).  To ensure compliance, the FDA conducts inspections of medical device manufacturers.  Violations found in these inspections can result in penalties and warnings.

Corrective Action and Preventative Action (CAPA)

A major stumbling block for many medical device manufacturers is establishing effective CAPA processes.  These processes are defined in Section 820.100 of Title 21 of the Food and Drug Administration Department of Human Services Sub-chapter H – Medical Devices.  This section defines seven Corrective and Preventive Actions:

(a) Each manufacturer shall establish and maintain procedures for implementing corrective and preventive action. The procedures shall include requirements for:

  1. Analyzing processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product, or other quality problems. Appropriate statistical methodology shall be employed where necessary to detect recurring quality problems;
  2. Investigating the cause of non-conformities relating to product, processes, and the quality system;
  3. Identifying the action(s) needed to correct and prevent recurrence of nonconforming product and other quality problems;
  4. Verifying or validating the corrective and preventive action to ensure that such action is effective and does not adversely affect the finished device;
  5. Implementing and recording changes in methods and procedures needed to correct and prevent identified quality problems;
  6. Ensuring that information related to quality problems or nonconforming product is disseminated to those directly responsible for assuring the quality of such product or the prevention of such problems; and
  7. Submitting relevant information on identified quality problems, as well as corrective and preventive actions, for management review.

(b) All activities required under this section, and their results, shall be documented.

Continual Improvement

The procedures identified in Section 820.100 comprise a system of of continual improvement.  They are dynamic processes that ultimately involve participation of design, manufacture, and quality assurance teams.  Cooperation between these various sectors must be instilled and encouraged to reap the rewards of any QMS.  Ultimately this can be accomplished though continual education of all team members.  This education should include emphasis of the over all goals of ISO 13485:2016 and the specific processes in place for the execution of those goals.

CVG Strategy Can Help in the Implementation of ISO 13485:2016

Our quality experts understand the importance in processes and process improvement.  We offer a variety of Quality Management service to assist in the implementation and continual improvement of effective systems that save money and ensure customer satisfaction.  We can also have expertise in ISO9001:2015, AS9100D, ISO 27001:2013 and (AAR) M-1003 and can readily deliver compliant procedures and work instructions.  Contact us today to see how we can help.

 

 

Huawei’s Legal Problems Continue in the United States

huawei's legal problems
huaweis legal problems

Huawei’s Legal Problems in the United States

Huawei’s Legal Problems in the United States continue on multiple fronts.  The Chinese tech giant has been the target of the U.S. Senate, The Department of Justice, and has had a case against U.S. Government contracts ban dismissed before going to court.

Department of Justice Actions

In an ongoing indictment the U.S alleges that Huawei participated in a fraudulent scheme to export banned U.S. goods and technologies for its business in Iran.  Although Huawei has denied these allegations, Reuters has reported that recently released company records show that the company was directly involved in these actions.  This could lead to Huawei’s chief financial officer, Meng Wanzhou’s extradition from Canada where she is being held on bank fraud and other allegations.

US Senate Actions

The Wall Street Journal reported that the U.S. Senate approved a bill that would replace Huawei Technology Co. telecom equipment in rural areas.  The bill would provide $ 1 billion in funding for approximately 40 rural carriers to replace equipment that could be used by the Chinese government to spy on communications routed through their equipment.  The bill will now move on to President Trump who will likely sign it into law.  Telecommunications Industry Association chief executive David Stehlin commented that the legislation was “a critical step in securing our network and ensuring the integrity of the telecommunications supply chain as we usher in the 5G era.” 

Case Dismissed

A lawsuit that challenged a U.S. law barring the government from using Huawei equipment, was dismissed in a federal court in Texas before going to trial.  This ban further underlines the U.S. governments security concerns of using the company’s products.  These concern has been very strong among lawmakers in both parties in light of continued cyberattacks and intellectual property theft by agents of the Chinese government. 

What This Means for U.S. Businesses

Businesses will have to exercise increased vigilance regarding the security of intellectual properties and technologies.  This will involve developing and improving processes involving export compliance and cyber security.  CVG Strategy has the expertise to help businesses of all sizes meet these challenges.  Contact Us today to see how we can help.

 

Electromagnetic Pulse Vulnerabilities and Product Design

Electromagnetic Pulse Vulnerabilities
Electromagnetic Pulse Vulnerabilities

What is an Electromagnetic Pulse?

Electronic products have Electromagnetic Pulse Vulnerabilities that could cripple infrastructure systems across the planet.  It is a serious concern that a number of agencies have reported on at length.   The Critical National Infrastructure Commission report of 2008 is one such example that outlines some dire possibilities.

Electromagnetic Pulses (EMP) can be both natural and man made.  Naturally occurring, these transient electromagnetic disturbances can be caused by lightning strikes, meteor explosion in earth’s atmosphere, or Coronal Mass Ejections (CME) caused by solar flares.  Man made disturbances include High Altitude Electromagnetic Pulses (HEMP) created by a nuclear explosions as high as thirty km above sea level and a variety of smaller weapons designed to disable pinpoint targets.

EMP events have a wide frequency range from DC to 1 GHz that have a duration of several nanoseconds.  This results in electric fields in thousands of Volts that can induce extremely high currents into electrical and electronic systems resulting in damage or complete destruction.  For those events caused by nuclear explosion, a second low frequency current caused by the disruption of the Earths magnetic field can cause major damage to power distribution systems.

Designing for EMP

A number of steps can be taken at the design stage for equipment that is considered safety critical.  These include screening, filtering of all power and I/O leads, and inclusion of voltage limiting components into a circuit.  Once a design has been implemented a variety of test methodologies are available for design evaluation.  While most of these involve military standard developers of products for commercial applications are often not restricted from their usage.  For example MIL-STD-461 RS105 is a standard used for shipboard equipment above and below deck to verify equipment’s ability to withstand transient electromagnetic field events. 

Consideration of inclusion of such testing into a test program should be taken for equipment that is critical to infrastructure requirements.  These types of equipment could include:

  • Electric Power
  • Telecommunications
  • Financial Service Industry Information Systems
  • Petroleum and Natural Gas Infrastucture
  • Transportation Infrastructure
  • Water Infrastructure
  • Food Infrastructure
  • Emergency and Health Services

CVG Strategy

CVG Strategy EMI/EMC consultants can perform a Susceptibility Analysis to identify Electromagnetic Pulse Vulnerabilities and provide design modifications to create products that can endure EMPs.  We can also recommend appropriate test and evaluation methodologies to verify these designs.  Contact us today to see how we can help.

Cybersecurity Maturity Model Certification (CMMC)

Cybersecurity Maturity Model Certification
Cybersecurity Maturity Model Certification

What is Cybersecurity Maturity Model Certification?

The Office of the Under Secretary of Defense for Acquisition & Sustainment has released the Cybersecurity Maturity Model Certification program.  The program will be made effective in new programs released by the Department of Defense (DoD) and will be a requirement for product and service providers.  This program has been formed to enhance the protection of unclassified information within the supply chain.  This information can be broken down into the following categories:

  • Federal Contract Information (FCI) – Information provided by or for the Government that is not intended for public release
  • Controlled Unclassified Information (CUI) – Information that requires safeguarding as defined by various government policies, regulations and laws.

The CMMC is a cooperative effort between the DoD and industry to provide a set of processes and practices to protect information from multiple cybersecurity standards and frameworks. 

The Importance of CMMC

Cybersecurity threats are increasing at a staggering rate.  Many of these threats are conducted at by hostile nation states such as the People’s Republic of China, North Korea, and Iran.  These attacks have resulted in the theft of classified information.  They have also resulted in massive economic losses.  The Center for Strategic and International Studies estimated that the global cost of cybercrime was as high as $600 billion in 2017.  Because an actual dollar figure cannot be placed on the loss or compromise of data, the actual cost far exceed these numbers.

The Structure of Certification

The framework of the CMMC model encompasses multiple domains.  Each of these domains involve processes that are comprised of 5 different levels.  For a given domain there are also five levels of capabilites.  Each capability is comprised of one or more practices.  These levels as shown in the figure below are cumulative.  An organization must demonstrate achievement of lower levels to receive certification for upper levels.

 

CVG Strategy

CVG Strategy cybersecurity consultants can assist you in meeting the requirements of CMMC.  Contact us today to see how we can help.