William McBorrough

The GSA Office of Inspector General (OIG) has issued a new audit examining product data within the Multiple Award Schedule (MAS) program. The OIG found inconsistencies in manufacturer names and part numbers within GSA Advantage! and Transactional Data Reporting (TDR) that can limit the effectiveness of FAS pricing tools and make product comparisons more difficult. The OIG made six recommendations aimed at improving product data accuracy and standardization. FAS concurred with one recommendation and partially concurred with five, citing ongoing efforts to improve data quality and pricing analysis. Read the report: https://lnkd.in/eha8tjvu #govcon #GSA

7

National Institute of Standards and Technology (NIST) has released a draft of the Transit #Cybersecurity Framework Community Profile to align with transit sector priorities, outlining 3 areas: securing #Criticalassets, collaborating with partners, and continuously improving internal capabilities. https://lnkd.in/g2UjbCHt #infoSec

9

Audit Retrospective: Gaps in Mitigating Restrictive Software Licensing A 2023 GAO review found that restrictive software licensing practices impacted Department of Defense cloud computing efforts, yet the DOD lacked the guidance and plans to effectively mitigate these risks. This underscores the persistent challenge of managing vendor lock-in and preserving flexibility in large-scale IT modernization. The audit assessed how restrictive licensing practices affected DOD cloud services and evaluated the department's mitigation efforts, reviewing selected components and investments. Auditors identified that practices like vendor bundling and cross-platform fees increased cloud infrastructure and licensing costs, though specific amounts were not quantified. The review found that vendor restrictions limited the choice of cloud service providers, with some investments effectively locked into a single provider due to cost-prohibitive migration. It noted that the DOD's guidance did not require components to analyze impacts for established IT investments or to develop plans for mitigating adverse licensing terms. The report documented that, of six selected investments, none fully addressed the key industry practices of identifying, analyzing, and planning to mitigate restrictive licensing impacts. Reports like this are critical benchmarks, revealing systemic gaps that drive the development of more robust acquisition and risk management frameworks. The underlying issue of navigating complex vendor agreements to maintain strategic flexibility is universal: what processes has your organization established to identify and mitigate restrictive licensing clauses before they impact cost and operational agility? For detailed findings, review the 2023 GAO report GAO-23-106290, “DOD Software Licenses: Better Guidance and Plans Needed to Ensure Restrictive Practices Are Mitigated.” #GAO #Audit #ITAcquisition #CloudComputing #VendorManagement #RiskManagement #SoftwareLicensing #ContinuousImprovement

1

In 2014, DHS alerted OPM to an intrusion. Instead of closing it immediately, the decision was made to observe, to understand the actor, build a coordinated removal plan, do this the "right" way. While defenders were watching that intrusion, a second foothold came in through contractor credentials. It was missed. It survived the cleanup. It became the pipe that exfiltrated background investigation data for 21.5 million people. Nobody tricked us. We chose to observe instead of act. Confidence in "we understand this actor well enough to remove them" is exactly what created the blind spot that cost us the crown jewels. I think about that case every time someone tells me attribution is the foundation of a mature security program. Attribution has real value at one layer only, clustering behavior into detection signatures and remediation playbooks. That's actor-agnostic. You don't need to know it's Russia to know the lateral movement pattern and shut it down and agentic detect/remediate tooling is making that layer faster and less dependent on humans doing the naming at all. Naming the nation-state, publishing the "who's behind it" report, feeding the insurance questionnaire does little for the defender. Sanctions and indictments don't move actors with nothing to lose. Ransomware crews rebrand faster than takedowns can repeat. Sophisticated attackers have been planting false flags, manually, in their own code for a long time. Olympic Destroyer, the malware that hit the 2018 Winter Olympics opening ceremony, carried code artifacts pointing to North Korea, China, and Russia all at once. It took analysts months to work out it was Russia's GRU, retaliating for the doping ban, deliberately dressed up to look like someone else. What that layer of attribution reliably does is justify the board line item. $5M for the platform. $2M for the insurance premium. Attribution-as-theater, dressed as strategy. The uncomfortable version of this is pursuing attribution isn't neutral overhead you can ignore if it doesn't help. When observation becomes its own institutional mission, it competes with the mission of actually closing the door. OPM is what happens when intelligence value wins that fight. In a post-Mythos world, where AI lowers the skill floor and widens the pool of who can run a sophisticated intrusion, we need less energy spent on the whodunit and more on the deterministic parts: know your crown jewels, cut dwell time, don't let curiosity about the actor delay eviction. Curious where people land on this especially anyone who's sat inside a CTI program built the old way. #threatintelligence #cybersecurity #incidentresponse #agenticai

11

1 Comment

I was in AFCEA's Signal talking about the Cyber Security Risk Management Construct (CSRMC), which is the DoW's new replacement for the Risk Management Framework. Change is good, and some of the streamlining is excellent. However, you're always dealing with the checklist nature of the compliance beast, and like most things, it comes down to intelligent execution. https://lnkd.in/e3nQ6_J5

21

Federal Software Security Policy Shift OMB has rescinded the Biden-era guidance in M-22-18 that standardized SBOMs and secure-software attestations for federal procurement. The new memo, M-26-05, gives agencies more discretion to define risk-based assurance requirements and to request SBOMs where they see value. What changes is the mandate. What doesn’t change is the risk. SBOMs remain a practical tool for supply chain visibility and vulnerability response, but the emphasis is shifting from uniform checklists to mission-driven assurance. Bottom line: real security still comes from observable, actionable practices in production, not just artifacts. #Cybersecurity #SBOM #SupplyChainSecurity #DevSecOps #GovTech

3

3 Comments

If you’re interested in OT cybersecurity, this webinar will walk you through the recently released "Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators". You’ll learn the steps to building and maintaining a robust asset inventory, because if you don’t know what you have, you can’t protect it. #otsecurity #securebydesign #cybersecurity

6