CMMC Still on Schedule Despite Covid-19 Setbacks The Cybersecurity Maturity Model Certification (CMMC) is still on schedule according to articles posted by National Defense Magazine.  CMMC was developed by the Department of Defense and industry as an effective means of implementing a risk based management approach to cybersecurity.  The first draft (Version 1.0) was released

Bloomberg reported on February 12, 2021 that a Supermicro hardware hack had been conducted on server motherboards by a Chinese espionage program.  This report follows previous reports by the news agency in 2018 and illustrates the susceptibility of technology manufacturers to supply chain attacks.  The hack involved embedding a small integrated circuit into the trace

International trends in cybercrime show an increasing sophistication by both organized crime and hostile nation states.  These cybercriminals are continuing their efforts against high-value targets that include the industrial, IT, and infrastructure sectors.  This activity is occurring at a time when many organizations are struggling to develop integrated cybersecurity solutions. Cybercrime Exploitation of Uncertainty Cybercrime

Karlton Johnson chairs CMMC-AB after serving as interim since September of 2020.  The accreditation body can now continue in its efforts to accredit sufficient assessors to certify the cybersecurity maturity of Department of Defense contractors.  The body had faced a challenges when on September 2, 2020 two members of the Cybersecurity Maturity Model Certification Accreditation

An Interim CMMC version was released on September 29, 2020 finishing off a tumultuous month at the organization.  On September 2, 2020 two members of the Cybersecurity Maturity Model Certification Accreditation Board were voted off in the midst of a conflict of interest controversy involving a pay to play strategy.  Karlton Johnson is now the

The National Institute of Standards and Technology (NIST) has released a baseline guidance for IoT device Cybersecurity. Internet of Things (IoT) refers to computing devices that integrate physical and/or sensing capabilities and network interface capabilities.  Providing security for these devices becomes more challenging as they become smaller, more prevalent, and capable. The Growth of IoT

Employee cybersecurity negligence is still a major cause of risk for businesses.  Despite an increased emphasis on training people, human error and bad habits continue to endanger sensitive information. Data Breaches on the Rise Institutions of all types have seen a dramatic increase in the number of cyber attacks.  This has been especially the case

Ransomware may have been the possible cause of death of a patient in Dusseldorf.  A ransomware attack on thirty servers at the Dusseldorf University hospital on September 9, 2020 prevented immediate emergency treatment and resulted in the patient having to be transported to a facility 20 miles away where she died from a delay of

Video conferencing application vulnerabilities have been frequently in the news during the Covid-19 pandemic.  During this time the use of these apps has skyrocketed due to remote work and schooling.  This has presented a tempting target for cyber criminals to steal information and disrupt activities. Zoom Bombing Incidents AL.COM reported that Saturday night Jewish prayer

Denial of Service attacks (DoS) occurs when a targeted host or network is incapable of responding to legitimate users as a result of being flooded by traffic from the attacker.  Businesses worldwide have reported an increased number of these kinds of attacks.  Because these attacks result in inaccessibility of an organization’s resources and service, they

IP Theft and National Security IP Theft and national security have been in the news a lot of late.  Most of this news has been centered around the activities of the Chinese military.  As a result commercial and defense technologies are at risk.  Fortunately, the United States has implemented a number of measures aimed protecting

Military cybersecurity strategies have developed in the last decade.  General Paul Nakasone, Commander of United States Cyber Command and Director of the National Security Agency recently shared his perspectives on how to approach cyberspace in Foreign Affairs magazine. Employing Proactive Cybersecurity Approaches Cyber Command was established in 2010 to protect military operations networks from cyber

The National Security Agency and the Department of Defense have issued a warning about Russian cyber espionage malware known as Drovorub.  This malware provides file download and upload capabilities to external actors when deployed on a victim Linux system.  It utilizes a number of means of concealing itself once implanted and is resilient to rebooting. 

Ransomware is a growing problem for organizations.  The rate of increase in incidents is skyrocketing in governmental agencies and small to medium businesses.  The Cybersecurity and Infrastructure Security Agency (CISA) estimates that a ransomware incident occurs every 14 seconds.  While the average costs of ransoms are increasing the real cost to an organization is downtime

The Cybersecurity and Infrastructure Security Agency (CISA) has released Teleconferencing Guidance for education.  Remote classroom teleconferencing has continued to grow.  As a result it has been a tempting target for cybercrime. Recommendations for K-12 Schools School districts are increasingly using teleconferencing tools to deliver their services.  These tools have increased in availability and capability.  Their