CUI Informed

Author of CUI Fundamentals and CUI Informed, two books about the United States Government's Controlled Unclassified Information ("CUI") program.  For more details, visit https://CUIInformed.com

Author

FutureFeed

Leveraging my deep understandings of legal, regulatory, and technical issues to develop educational materials and other content to help FutureFeed's customers better manage their cybersecurity programs.

General Counsel and Director of Education and Content

CMMC Information Institute

Co-Founder

Fathom Cyber

Formed consulting business which helped organizations create business-oriented, defensible cybersecurity (cyber-security, cyber security) and data privacy (information security) programs using leading industry standards and security controls including the NIST Cybersecurity Framework, Center for Internet Security Top 20 Controls, NIST SP800-39, NIST 800-171, and ISO 27001/2 to meet and exceed legal and industry requirements such as HIPAA, PCI, GDPR, and the New York State Department of Financial Services Rule 500.  Responsible for corporate formation, content creation, partnership programs, and business development.  Created go-to-market strategy, designed marketing and sales pieces including website content.  Stood up and maintained website.  Created business and financial plans.  Responsible for sales of consulting capabilities to prospective clients and for client relationship management.  Identified business partners and negotiated related agreements.  Acted as corporate spokesperson, including speaking at conferences and representing the company as part of government and industry organizations.

CEO and General Counsel

Drexel University's Thomas R. Kline School of Law

Adjunct professor of cybersecurity.  Created undergraduate and graduate-level (Master of Legal Studies and Juris Doctorate) classes which teach my students how to create defensible cybersecurity and data privacy plans.  This includes leveraging enterprise risk management-based concepts and tools to define the organization and its approach to risk definition and analysis, and using industry standards and best practices to create programs, policies, and procedures which address these risks.  We also address ideas such as cyber insurance, incident response plans, penetration testing, vulnerability and threat detection and mitigation processes (from a nontechnical perspective), and fundamental network and computer concepts including firewalls, routers and switches, antivirus tools, SSL certificates, and the differences between individual security controls and frameworks.

Adjunct Professor

University of South Florida

Advisor to USF’s Executive CyberSecurity Education Program

Advisory Board Member

ClearArmor Corporation

Member of the senior management team and member of the Board of Directors.  Lead the strategic vision, planning, and implementation of an innovative, leadership-driven, risk-based approach to cybersecurity (cyber-security, cyber security) which leverages the NIST Cybersecurity Framework and other industry standards and best practices.  Co-created go-to-market strategies and messaging.  Created corporate policies and procedures, drafted standard contracts, and constructed business and financial plans to support maximum growth, profitability, and efficiency.  Spearheaded outreach to key stakeholders, partners, and vendors.  Acted as company spokesperson by speaking at conferences and serving as the company’s representative to industry organizations including the NIST National CyberSecurity Center of Excellence.  Participated in sales presentations and lead negotiations with customers and partners.  Built and maintained networks across broad sectors, including Boards of Directors, senior leadership, information technology, legal, and risk management professionals, and leveraged these networks to advance corporate mission.  Lead international development team.  Created internal information security and data privacy program (as part of my CTO/CISO role).

Vice President, General Counsel, Chief Technology Officer, and Director

The Johns Hopkins University Applied Physics Laboratory

Transformed the organization’s approach to identifying and protecting organizational assets and increasing the overall organizational value.  Lead a cross-functional team which identified and clearly defined organizational priorities.  Created new policies and procedures which provided a more dynamic and agile culture and allowed the organization to achieve more effective governance.  Worked closely with IT and procurement staff to drive down operational costs and reduce organizational risk.  Appointed as first representative of the legal department to the organization’s cybersecurity steering committee.  Taught courses on a variety of legal and technology topics.  Researched legal issues, presented findings to senior leadership team, and managed outside counsel in support of litigation.

Senior Associate General Counsel

Unisys

Created and implemented a proactive, business-oriented approach to legal services which lead to my group’s lawyers being recognized for our collaboration and problem-solving skills and our efforts to increase corporate profits while protecting and preserving shareholder value.  Drove broad-based, enterprise-wide cultural changes which resulted in legal services cost reductions while improving corporate morale and increasing corporate asset identification and protection by over 200%.  Worked closely with international procurement and contracts organizations to improve efficiencies and reduce corporate risk.  Served as Division IP Counsel for government contracts business unit and for international and domestic research and development centers.  Conducted due diligence for mergers, acquisitions, and divestitures.  Lead effort to monetize certain corporate assets.

Senior Patent Counsel

Greenberg Traurig, LLP

Worked with wide range of clients, from start-ups to Fortune 100 companies, to create and implement highly customized, business-oriented approaches to intellectual property protection.  Identified corporate priorities, and ensured that advice given, and actions taken, were consistent with the client’s business priorities and needs.  Assisted clients in crafting business and financial plans in pursuit of venture capital.  Conducted due diligence for mergers and acquisitions.  Supported litigation efforts.

Associate

Created and deployed intellectual property strategies for clients, including government contractors.  Performed legal research and drafted responses in support of litigation.  Prepared and prosecuted patent applications.

Patent Agent

I am a cybersecurity expert turned lawyer turned cybersecurity expert, and I have experience that runs the gamut from high-level public policy and organization design to hands-on technical implementation, fundraising, business management, and sales.  

I am now the General Counsel and the Director of Education and Content at Continuous Compliance LLC dba FutureFeed. In that capacity, I often help the owners and practice leaders of MSPs, consultancies, etc. to build cyber compliance as a service offerings.

Previously, I helped build the CMMC Accreditation Body (CMMC-AB - now the CyberAB).  This included creating the CyberAB’s Registered Practitioner training program.  Since stepping down from the CyberAB, I earned Provisional Instructor, Certified CMMC Assessor, and Certified CMMC Professional certifications.

In addition to my "day job" with Continuous Compliance, I created and run the CMMC Information Institute.  I am also an Adjunct Professor at the Rochester Institute of Technology, where I am helping them build cyber/compliance and assessment curricula for United States Veterans who are transitioning to civilian life.  I am a former professor of cybersecurity at Drexel University, where I created highly ranked courses for both the law and business schools.

Over the last several months, a hacker group calling itself Cyber Army of Russia has posted screen capture videos in which it's shown tampering with control software for US water utilities, a Polish wastewater plant, and what it describes as a French hydroelectric dam. 

Now a report from Mandiant (now part of Google Cloud) ties the group to the hackers known as Sandworm, the most aggressive and disruptive unit of Russia’s GRU military intelligence agency.

Multiple US water facilities in Texas appear to have suffered real, if temporary effects: One reports a water tank overflowing, and at least four took their digital control systems offline until they could secure them.

In a somewhat absurd twist, though, the French "hydroelectric dam" Cyber Army of Russia claimed it targeted was in fact a small water mill in a village of 300 people, as revealed in a report from the French newspaper Le Monde.

While Cyber Army of Russia appears to have been created by Sandworm and has collaborated with them, the haphazard nature of the group's targeting and techniques suggests it also likely operates independently as a "hacktivist" group. But that may mean it will continue to demonstrate even less caution or discretion than the GRU's own hackers like Sandworm have. 

“Someone under this persona is doing some really aggressive stuff, and they’re doing it globally, and they could ultimately cause a very real incident,” says Mandiant's John Hultquist. “If this is just some random group of hacktivists who lack the structure and restraint of a military organization, they may cross lines in ways that no one anticipates.”

James Goepel

wired.com • 5 min read

Hackers Linked to Russia’s Military Claim Credit for Sabotaging US Water Utilities

A quick note to keep everyone in the loop on two important NIST publications in the Controlled Unclassified Information (CUI) series moving rapidly through the final stages of development.

Today, we passed a critical milestone point in the development process for SP 800-171 (Revision 3) and SP 800-171A (Revision 3). Both publications have cleared the Editorial Review Board and have received final approval for publication.

The next step is to finalize the supporting material that will accompany the release of the two publications next month. This includes an updated FAQ, analysis of changes, and a CUI overlay--all created to help our customers better understand and use the updated publications.

Simultaneously, the project team is also preparing data sets for the NIST Cybersecurity and Privacy Reference Tool (CPRT) to support real-time access to the updated SP 800-171, Revision 3 security requirements and the SP 800-171A, Revision 3 assessment procedures. This continues NIST’s commitment to providing critical content to our customers in a timely manner through web-based, automated delivery systems and in multiple data formats.
https://lnkd.in/evMfdszC

In addition to the authors who are responsible for the technical content of the publications, there are many people behind the scenes on the development team who contribute to getting the content ready for our customers. They do a great job time and time again and we appreciate their hard work and dedicated professionalism.

It’s been a long road, but we are almost there. Thanks again for your patience and your participation in the process.

Coming soon to a web site near you. "Next Gen" 800-171 and 800-171A.

Keep our nation safe and secure.

#NIST800171Rev3 #SecurityRequirements #NIST800171ARev3 #AssessmentProcedures #ProtectCUI #DIB #CMMC #CyberSecurity

Did you know that the Controlled Unclassified Information ("CUI") program isn't something that the United States Department of Defense created?  

The identification and safeguarding of CUI is actually a requirement that applies to the entire Executive Branch of the federal government.  Under the CUI program, ALL federal agencies are supposed to be ensuring that contractors (and other authorized recipients) can properly safeguard CUI before the agencies entrust #CUI to the contractor.  This includes ensuring that contractors meet the requirements in NIST SP 800-171, just like DoD is doing with the Cybersecurity Maturity Model Certification ("#CMMC") program.

There is a new addition to the Federal Acquisition Regulations ("FAR") pending (called the "FAR CUI Rule") that will ensure all agencies meet this important requirement.  If you are a government contractor, even if you aren't a #DoD contractor, you #need to understand at least the basics of the CUI program.

Join me Monday, May 6 at CMMC Day (https://CMMCDay.org) for my session "Controlled Unclassified Information: A Primer" to learn more about the CUI, including:
 📂the origins of the CUI program;
 📂who gets to designate information as CUI;
 📂how to designate information is CUI;
 📂who is supposed to mark information as CUI;
 📂how to mark information as CUI;
 📂how to handle unmarked CUI in contractors' environments;
 📂when copies and derivative works of CUI are CUI; and
 📂much more!

I'll also be giving away a few copies of CUI Fundamentals and CUI Informed at the conference.

I look forward to seeing everyone there!

#CMMCDay #CMMC #CUI #Infosec #InformationSecurity #Cyber #Cybersec #Cybersecurity #education #conference #community #learning #Defense #DoD

🚩 Alert: An undisclosed third-party provider for Cisco Duo, Cisco’s multi-factor authentication (#MFA) service, suffered a social engineering cyberattack. Cisco Duo customers were warned to be on alert for follow-up #phishing attempts. Cisco Duo released a statement notifying that the threat actor had used compromised employee credentials to access the systems and download SMS logs from specific users.  
 
📰 Read more: https://ow.ly/6wun50Rkcpq 

#cybersecurity #cyberincident #databreach #NJCCIC

cyber.nj.gov

Cisco Duo | Public Data Breaches | NJCCIC

We have observed an uptick in various business email compromise (#BEC) scams, especially invoice, direct deposit, and real estate wire transfer #scams. BEC scams are the second most expensive type of #cybercrime, with New Jersey ranking second nationwide with an average loss of $223,041.73 per victim in 2023. Unlike generic phishing scams, BEC scams are a highly targeted form of social engineering, often incorporating preliminary reconnaissance on potential victims and using various impersonation techniques, including email #spoofing and look-alike domains. Common attacks include direct deposit and real estate wire transfer scams.   

In direct deposit or payroll diversion scams, threat actors impersonate an employee, typically by registering a free email address using the employee’s name and utilizing display name spoofing in the messages. They usually send fraudulent emails to payroll or human resources departments, and direct deposit change forms are requested.  

In real estate wire transfer scams, threat actors impersonate and target real estate attorneys or title agents to defraud homebuyers. These requests typically instruct the buyer to perform a wire transfer and transfer the closing costs to an account controlled by the threat actors.  

The NJCCIC recommends that users:  

✔ Refrain from interacting with messages and attachments from unknown senders  

✔ Navigate directly to official websites and verify legitimacy  

✔ Utilize strong passwords and multi-factor authentication  

Read the full post here 👉  https://ow.ly/RqU450RfbWS 

#cybersecurity #phishing #NJCCIC

Uptick in BEC Scams | Latest Alerts and Advisories | NJCCIC

"Most of the targets were defense contractors, according to the indictment. The men allegedly managed to compromise a management account at a U.S. defense company and then create fake accounts within the company. They are accused of using the fake profiles to target other companies with spearphishing scams, or phishing attacks focused on scamming individuals or small groups."

wng.org • 2 min read

Iranians tried to hack U.S. defense firms, says Justice Department

🚩 Alert: #Cybersecurity researchers at Volexity discovered a zero-day #vulnerability in the Global Protect feature of Palo Alto Networks PAN-OS. Palo Alto Networks’ response team identified the vulnerability as CVE-2024-3400, an OS command injection allowing unauthenticated remote code execution.  

The NJCCIC recommends users:  

✔ Immediately apply hotfixes  

✔ Review the Indicators of Compromise (IOCs) provided by Palo Alto’s threat brief 

For more information: https://ow.ly/rLBL50RnlkE 

#cyberthreat #NJCCIC #infosec NJOHSP

ow.ly

Rise in Exploitation Attempts of PAN-OS Vulnerability | Latest Alerts and Advisories | NJCCIC

If your company is a United States Department of Defense (“#DoD”) contractor or someone who provides services to them, you’ve probably (hopefully!) heard about the #Cybersecurity #Maturity #Model #Certification (“#CMMC”) program.  And as part of your education about CMMC, you probably learned about the #False #Claims #Act (“#FCA”), which penalizes government contractors for making material, false #compliance claims to the government.

Under the FCA, not only the government, but also whistleblowers (i.e., those with information or belief that a false claim has been made), can bring suit for a false claim.  These whistleblowers can receive 15-30% of any damages awarded to the government as a result of their suit.  This creates a strong incentive for employees and business partners to report wrongdoing.  The U.S. Department of Justice’s (“#DoJ”) new(ish) #Civil #Cyber #Fraud initiative has amped up the heat on #government #contractors, and DoJ is seeing a significant increase in the number of #whistleblower cases.  

But what happens when you want to be a whistleblower, but you’re caught up in the middle of things? Is it fair to come forward and report misdeeds, only to be prosecuted by the same people to whom you’ve reported the problems?  DoJ appears to think that the answer is “no”, and they have created a new program that takes some of the potential sting out of being a whistleblower. 

Under this pilot program, individuals with criminal exposure—not including CEOs, CFOs, high-level foreign officials, domestic officials at any level, or individuals who organized or led the criminal scheme—who come forward and report misconduct that was otherwise unknown to DoJ will be eligible to receive a non-prosecution agreement (“NPA”) if they meet certain criteria. Culpable individuals will receive an NPA if they (1) voluntarily, (2) truthfully, and (3) completely self-disclose original information regarding misconduct that was unknown to DoJ in certain high-priority enforcement areas (including government contracts), (4) fully cooperate and are able to provide substantial assistance against those equally or more culpable, and (5) forfeit any ill-gotten gains and compensate victims. The pilot program is designed to provide predictability and certainty by offering a pathway for culpable individuals to receive an #NPA for truthful and complete self-disclosure to DoJ.

This will likely further increase the number of whistleblower cases, and increase pressure on government contractors to ensure they are complying with various regulations.

More details are in the announcement, below.

Taplio

James Goepel's Linkedin Analytics

James Goepel

James Goepel's Best Posts (last 30 days)

Want to drive more opportunities from LinkedIn?

Taplio

.css-1jgreyo{background-image:linear-gradient(284deg, rgba(39,43,72,1) 0%, rgba(33,47,183,1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}James Goepel's Linkedin Analytics

James Goepel

James Goepel's Best Posts .css-qqfgvy{font-size:var(--chakra-fontSizes-md);}(last 30 days)

Want to drive more opportunities from LinkedIn?

James Goepel's Linkedin Analytics

James Goepel's Best Posts (last 30 days)