CYBERLAW: May 8, 2019 — A Hallmark Day in Cybersecurity
The Recent False Claims Act (FCA) Decision Markus v. Aerojet Rocketdyne Holdings Inc. May 8, 2019 THE day that changed...
Dr. Mark Russo
Dr. Russo is currently the Senior Data Scientist with Cybersenetinel AI in Washington, DC. He is a former Senior Information Security Engineer within the Department of Defense's (DOD) F-35 Joint Strike Fighter program. He has an extensive background in cybersecurity and is an expert in the Risk Management Framework (RMF) and DOD Instruction 8510, which implement RMF throughout the DOD and the federal government. He holds a Certified Information Systems Security Professional (CISSP) certification and a CISSP in information security architecture (ISSAP). He has a 2017 Chief Information Security Officer (CISO) certification from the National Defense University, Washington, DC. Dr. Russo retired from the US Army Reserves in 2012 as a Senior Intelligence Officer.
SPOT: Policy v. Procedure
There is a Difference... POLICY: Broad and informative high-level description of principles focused on a particular topic area. For example,...
TOP 10: Cybersecurity Policies (NIST)
How to Demonstrate a Strong Security Posture A continuing focus on the third-leg of of the cyber-Body of Evidence (BOE),...
The 8 Key Elements of an Effective Cybersecurity Policy Document
Standard Categories for Your Cyber Policy Artifact (I have been getting a lot of requests for help in this area...I...
GUIDE: The Threat Hunt Response Engagement & Action Team (THREAT)
The “Optimal” THREAT Task Organization The most common question at this point of anyone looking at the Threat Hunt concept...
TOP 7: “Cyber-Analytics” Journal Articles (2019)
It's time we measure how well we are really doing with Cybersecurity using Data Science "Cyber-Analytics: The application of data...
PATHWAY: Supply Chain Risk Management (SCRM) 1.0 Framework
A Cybersecurity "Strawman" Offering Supply chain risks include the insertion of counterfeits, unauthorized production, tampering, theft, insertion of malicious software...
DOD’s Role in Responding to Malicious Cyber Activity
Q: When is self-defense defensive? A: Never Whether in the physical/kinetic or virtual/cyber world self-defense is never truly defensive. There...
SUGGESTED READING: “Neural Networks”
For the budding Data Scientist, Engineer or Manager The following is part of a series on academic resources of interest...
Q: What are we MISSING in the SCRM Discussion?
A: More than 50% There are many historical examples how we as humans have missed the mark. It was not...
So, you’re now a Security Control Assessor (SCA)
Elements of Good Audit Practices There are several activities that will help the security auditor prepare for a formal assessment. ...
Why System Development continues to be a challenge?
The PPT "Triangle" is at the root of this issue Origins The People-Process-Technology (PPT) Triangle has a less than defined...
Why I hate contract-to-hire?
...and 6 months (or less) contracts to boot Is anyone else tired of getting these positions? I keep getting them,...
We play chess, they play WEI-QI
How the Chinese are beating us in the long game The games we play as children tell us many things....
Cisco Systems Survival in the “Age of China”
John Chambers, former CEO, lays the foundation of Cisco's long-term success and profitability For any one who works actively within...
CYBERLAW: STEVE JACKSON GAMES, INC., et. al., Plaintiff-Appellants, v. UNITED STATES SECRET SERVICE, et. al., Defendants, United States Secret Service
No. 93-8661 UNITED STATES COURT OF APPEALS FOR THE FOURTH DISTRICT 36 F.3d 457; 1994 U.S. App. LEXIS 30323 October...
EDITORIAL: Do We Need to Add a “Data Inventory” to the SSP?
The System Security Plan (SSP) contains three major architectural artifacts...is it time for a fourth? The SSP and its three...
Creating a Virtual SOC
This is an analysis of the Logrhythm(R) SIEM Product, its implementation, and potential cost savings focused on a DOD IT...
“Best Practice” Should be a Process NOT a Catch-phrase
The Four Key Components Best Practice has been a long held position by many communities to include program management and...
The Coming Storm…Security Clearance & Polygraph Shortages
This is an update to my original June 22, 2017 article regarding the state of polygraphs. Even with current changes...
5 Current Myths in Cyber
These myths are holding us back. We need to think more critically of the implications and impacts Myth 1: "Information...
HHS’s Blockchain Initiative & Its Security Pitfall
A Review of Cybersecurity Shortsightedness I really enjoy attending the Washington DC's Chapter of the National Contract Management Association's (NMCA)...
BOOK: “The Signal and the Noise”
Considered one of the most insightful leaders in Predictive Analytics (PA) Silver, N. (2012). The signal and the noise: Why...
What’s Next for Better Cyber Predictive Analytics?
How can Predictive Analytics (PA) move forward to improve our ability to better anticipate problems and threats? The use of...
A Need for Better Cybersecurity Time Management
Some Suggestions for the Department of Defense A Hybrid-Risk Management Framework (RMF) Step 3 A challenge facing the Department of...
Cyber and Program Risk Management: Close Cousins…mostly
While not greatly different, there are some unique variations The history of Risk Management (RM) can be traced to the...
The Cybersecurity Skills Shortage is 50% Worse Than We Believe
The mainstream analysis is seriously flawed A shortage of nearly three million: This number may seem abstract,but it’s having a...
CONSIDER: Introducing “SPITS” as an Agile Cyber-Solution Framework
We consider the following mini-framework This is a discussion on an emerging cybersecurity tactical approach to inject an even lower...
2018 National Cyber Strategy: Barely a Wimper
What does this mean for federal contractors? The September 2018 "National Cyber Strategy" was released by President Trump with barely...
Supply Chain Risk Management (SCRM): The Next Major Crisis
Excellent article just appeared (Oct 4, 2018) in Bloomberg Businessweek: https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies A must-read of the Chinese infiltration into the US...
