Strength – Ability – Discipline

New Evidence Suggests SolarWinds’ Codebase Was Hacked to Inject Backdoor

As a Cyber Security professional for over 25 years I’ve seen a lot over the years. One thing that stands out is the hack of CCLeaner in 2017. Which appears now to have some similarities to the SolarWinds compromise. The result of the CCLeaner compromise has had lasting effects. Anyone who participates in CyberPatriot knows, CCLeaner is one of the first things to be removed from an image as it’s assumed to be compromised.

With this new evidence, will SolarWinds become the next security tool that’s considered more of a risk to run it than to not?

Source

Reflection on Risk Management Framework (RMF) Security Controls Assessment

I’m sitting here in the airport after finishing a 1 week Risk Management Framework (RMF) Security Controls Assessment (SCA) and reflecting on the week. This week the team and I reviewed nearly 30 hosts and over 3000 individual controls. I remember throughout the week there were many times thinking “this is pretty basic stuff, why aren’t they (the client) following the security guidance?”. It also underscores the need to get more Information Technology (IT) professionals trained in cyber security.

That’s why Cyber Centurion is proud to sponsor Civil Air Patrol NC-162 Squadron’s first CyberPatriot Team.

CyberPatriot is the National Youth Cyber Education Program created by the Air Force Association to inspire K-12 students toward careers in cybersecurity or other science, technology, engineering, and mathematics (STEM) disciplines critical to our nation’s future. At the core of the program is the National Youth Cyber Defense Competition, the nation’s largest cyber defense competition that puts high school and middle school students in charge of securing virtual networks.

The cadets on our team, who range in age from 13-16 began practice in April with basic computer skills and cyber hygiene concepts. Over the past several months they’ve progressed through the basic materials absorbing the information at an incredible pace. For many, this is their first exposure to managing operating systems and advanced concepts of computer security. They are excited to begin their first scored round and put their knowledge to the test.

Insights from Diversity in Cybersecurity

At RSA this year there was a big focus on diversity in the workforce. There were many sessions about how to increase women and minorities in the workforce. I attended most with hopes of gaining insights on not only how to hire these demographics but ALL demographics.

The shortage of Cyber professionals is somewhere between 500K and 3.5Million. That means that Cyber security is one of the few professions today with 0% unemployment. The rapid job growth is expected to reach 1.5 million positions by 2019.

The sessions during the week talked about increasing the female workforce from 10% to 20% or more. There are many challenges, and it is crucial to build the pipeline of candidates.

Attracting New Talent in Cybersecurity

How do we attract new talent to such an abstract and boring profession? Part of it is the money. With Cyber Security, professionals can make a good living! The other part is education; no one is born as a cyber guru, we all need to be taught and mentored.

If you’ve got children, get involved in organizations that promote cyber education like the Girl Scouts, CyberPatriot Program, and more. Encourage youth interested in pursuing careers in cybersecurity.

Leadership Lessons from Adventure Race

Recently, I competed in a 24-hour Adventure Race to test physical, mental and emotional fortitude. During the race, I learned important lessons about teamwork, leadership, and resilience:

  1. Helping others is always the right thing to do. One team exemplified this, providing constant support and encouragement, reminding us of the importance of community.
  2. Negativity can impede progress. A negative attitude among team members can demoralize and halt momentum.
  3. Sometimes you have to carry the team. As a leader, assisting others can keep the team moving forward.
  4. Let others take charge when needed. Trust your teammates to lead when conditions change.
  5. Adapt to changing conditions. In the face of unexpected challenges, reassess goals to ensure progress.
  6. Learn from your mistakes to avoid repetition. Conducting an After Action Review can help capture lessons learned.
  7. Never give up! Even when faced with difficult challenges, persistence is key to success.

In the end, the race was challenging, and while we didn’t finish, I learned valuable lessons that I’ll carry into my professional life.