Blog

Guide to Zero Trust Architecture for DoD: Building a More Resilient Defense

The landscape of cyber threats targeting the Department of Defense (DoD) is constantly evolving, demanding a paradigm shift in how we secure critical national assets. Traditional perimeter-based security, often described as a "hard shell, soft interior," is no longer sufficient against sophisticated adversaries. Enter Zero Trust Architecture (ZTA) – a strategic cybersecurity model built on

RMF Alignment with ISC2’s CGRC Exam

IT Dojo's training programs were developed with the information systems professional in mind. NIST’s Risk Management Framework is one of the most widely used governance, risk and compliance frameworks in the nation and forms the core of the ISC2 CGRC Exam Content (for exams after June 15, 2024). In fact, initially the certification was completely focused on the

Demystifying STIGs: Securing IT Systems with Compliance and Confidence

In the realm of cybersecurity, adherence to rigorous standards and best practices is paramount to safeguarding sensitive information and maintaining the integrity of IT systems. Among the essential tools in the arsenal of cybersecurity professionals are Security Technical Implementation Guides (STIGs). These comprehensive guides, developed by the Defense Information Systems Agency (DISA), provide detailed instructions

Elevate Your Skills: IT Dojo’s Comprehensive Course Offerings in Application Development and Security

In today's technology-driven world, staying ahead of the curve is paramount for IT professionals. Whether you're delving into application development or honing your skills in IT security, having access to high-quality training can make all the difference. At IT Dojo, we're committed to empowering individuals and teams with the knowledge and skills needed to excel

Embracing Zero Trust: Redefining Security in the Digital Age

In an era of ever-evolving cyber threats, traditional security models are proving to be inadequate in safeguarding sensitive data and systems. Enter Zero Trust, a revolutionary approach to cybersecurity that challenges the conventional notion of trust within networks. In this blog post, we delve into what Zero Trust entails, why it's crucial for modern businesses,

Mastering Agile: Embracing SCRUM for Efficient Project Management

In today's fast-paced and dynamic business environment, traditional project management approaches often fall short in delivering timely and impactful results. Enter SCRUM, a popular Agile framework that revolutionizes project management by promoting collaboration, adaptability, and iterative development. In this blog post, we delve into the principles of SCRUM and highlight how IT Dojo offers specialized

Mastering Fortinet: Elevate Your Security Expertise with IT Dojo’s Training Courses

In the realm of cybersecurity, having the right tools and expertise is crucial for protecting organizations from evolving threats and ensuring robust defense mechanisms. Fortinet, a global leader in cybersecurity solutions, offers a comprehensive suite of products designed to safeguard networks, endpoints, and data against a wide range of cyber threats. In this blog post,

Navigating the Cloud with Amazon Web Services (AWS): Empowering Innovation and Scalability

In today's digital landscape, businesses are increasingly turning to cloud computing to drive agility, innovation, and scalability. Among the leading cloud service providers, Amazon Web Services (AWS) stands out as a powerhouse, offering a comprehensive suite of cloud services to meet the diverse needs of organizations worldwide. In this blog post, we delve into the

Streamlining Workflows and Elevating Efficiency with ServiceNow: Revolutionizing Enterprise Service Management

In the digital age, businesses are constantly seeking ways to streamline operations, enhance productivity, and deliver exceptional service experiences. Enter ServiceNow, a leading cloud-based platform that empowers organizations to automate workflows, optimize processes, and transform the way they manage IT, employee, and customer services. In this blog post, we explore the transformative capabilities of ServiceNow

Strengthening Cybersecurity: Navigating the Risk Management Framework for DoD IT

In an era marked by evolving cyber threats and stringent security requirements, the Department of Defense (DoD) plays a pivotal role in safeguarding sensitive information and critical infrastructure. To effectively manage risks and ensure the security of DoD IT systems, the Risk Management Framework (RMF) serves as a comprehensive framework for cybersecurity governance and compliance.

The Imperative of Instructor-Led IT Training: Amplifying Learning Through Live Engagement

In the ever-evolving landscape of IT training, the debate between self-paced online courses and instructor-led training continues to thrive. While self-paced learning offers flexibility, the pivotal role of live, instructor-led training cannot be overstated, especially in the fast-paced world of technology. In this article, we'll delve into the significance of instructor-led IT training over self-paced

Unleashing the Power of Artificial Intelligence and Machine Learning: A Journey into the Future

In the realm of technology, few innovations have captured the imagination and transformed industries as profoundly as Artificial Intelligence (AI) and Machine Learning (ML). From enhancing business operations to revolutionizing healthcare and driving breakthroughs in scientific research, the potential applications of AI and ML are virtually limitless. In this blog post, we embark on a

Navigating the Risk Management Framework (RMF) for DoD and Government Agencies

In today's tech-driven world, safeguarding sensitive data and critical systems is a top priority, especially for government agencies, including the Department of Defense (DoD). They handle vast amounts of sensitive information, making the Risk Management Framework (RMF) an essential part of their cybersecurity strategy. In this article, we'll take a dive into RMF, what it's

NIST SP 800-53: WHAT’S THE DELTA FROM REV. 4 TO REV. 5?

BY KATHRYN DAILY, CISSP, CGRC (FORMERLY CAP), RDRP NIST SP 800-53 (National Institute of Standards and Technology Special Publication 800-53) provides a set of security and privacy controls for information systems and organizations. It was initially developed by NIST thanks to the E-Government Act of 2002, or more specifically, the Federal Information Security Management Act

RISK MANAGEMENT FRAMEWORK (RMF) TOMORROW: TRUTH OR FICTION?

BY LON J. BERMAN, CISSP, RDRP JULY 2023, VOLUME 15, ISSUE 3 When it comes to the future of RMF, rumors abound but truth is hard to come by. In this article, we’ll take a look at some of the speculations and see if there’s any truth to them. Let’s start with an oldie. “DoD

DoD Transition to NIST SP 800-53 Rev 5 … Why is it Taking so Long?

By Lon J. Berman, CISSP, RDRP Welcome to 2022! It’s now been well over a year since the release of NIST SP 800-53 Rev 5, yet Rev 4 remains the DoD standard. When DoD first adopted RMF … back in 2014! … they expressed their commitment to “keeping up” with the NIST publications. So why

Risk. What to Do With It.

By Kathryn Daily, CISSP, CAP, RDRP Recently our regional grocery store chain notified their employees and customers that they had a data breach involving some HR data and pharmacy records. The breach was caused by a vulnerability in the Accellion file sharing system which the grocery chain immediately stopped using. As I was perusing the

RMF Across the Government Landscape

By Lon J. Berman, CISSP, RDRP More than ten years ago, RMF came into existence with the intention of becoming the “unified information security framework for the federal government”. With widespread adoption of RMF throughout most federal civil agencies, DoD components and intelligence community agencies, it is safe to say that goal has been met.

Guaranteed to Run Live Remote Online Cisco Classes

Below is a list of upcoming Guaranteed to Run Cisco classes running in Live Remote Online format that are coming up. If you are interested, please reach out to Nick@itdojo.com. Details and pricing provided upon request. CLCOR: Implementing Cisco Collaboration Core Technologies 02-22 to 02-26 ENWLSD: Designing Cisco Enterprise Wireless Networks 03-01 to 03-05 SDWADV: Cisco SD-WAN

DFARS Compliance with CMMC/NIST SP 800-171

By Marilyn Fritz, CISSP, CISA, ITIL, PMP The new DFARS Interim Rule that went into effect November 30, 2020 is a game changer for any entities that have or are pursuing Defense Industrial Base (DIB) contracts or subcontracts. Prior to the new Interim Rule, contractors and sub-contractors could self-attest that they met DoD cybersecurity requirements

NIST Rev. 5 Supplemental Materials

By Kathryn Daily, CISSP, CAP, RDRP Back in September of last year (2020), NIST finally published the final version of Special Publication 800-53 Revision 5. Most notably, this revision incorporated privacy considerations in the security controls themselves rather than having separate control families for the privacy controls (e.g., AR, AP, IP, etc.). This is a

Welcome, Step 0

By Lon J. Berman, CISSP, RDRP Q. The Risk Management Framework (RMF) life cycle is comprised of how many steps? A. Oh, that’s easy, it’s six. Well … not so fast. As you probably know, the Risk Management Framework (RMF) has always been described as a six step process, to wit: 1-Categorize, 2- Select, 3-Implement,

CMMC – What We Know and What We Don’t

By Kathryn Daily, CISSP, CAP, RDRP So by now, I’m sure you’ve seen a ton of articles on the Cybersecurity Maturity Model Certification (CMMC) initiative. A lot of information has been released but there are still a lot of unknowns. What We Know We know that it’s mandatory for all contractors who wish to do

Ask Dr. RMF!

Dear Dr. RMF, I work in an Army program and I feel like I am getting the hang of RMF, but when the heck do I schedule an independent assessment (SCA-V)? Show Me the SCA-V Dear Show Me the SCA-V, When determining when to schedule a SCA-V assessment you'll want to take several things into

CMMC Is Here!

By Kathryn Daily, CISSP, CAP, RDRP So, in the last edition of the newsletter I wrote about the need for verification of NIST 171 compliance from DoD contractors, suppliers and vendors who process controlled unclassified information (CUI). Well, the DoD sure delivered on that request. A mere days after the last article was published, DoD

Cybersecurity Framework – Is it relevant to Federal/DoD organizations?

By Lon J. Berman, CISSP, RDRP Just when folks were beginning to get somewhat comfortable … or, at least, familiar … with the Risk Management Framework (RMF), along come our friends at the National Institute of Standards and Technology (NIST) throwing another framework our way! The Cybersecurity Framework (CSF) has actually been in development since

The Expanding Role of eMASS

By Lon J Berman, CISSP, RDRP The Enterprise Mission Assurance Support Service (eMASS) is a DoD system that serves as an information repository and workflow manager for the Risk Management Framework (RMF) process. The history of eMASS can be traced back to a project called Digital DITSCAP at the Defense Logistics Agency (DLA) in the

Where to Find CISSP Practice Questions?

We constantly get asked "Where is the best place to find CISSP practice questions?" and "What sort of resources can you share with me to help me prepare for the CISSP?" In an effort to consolidate all of the answers to these questions, we have put together this list of links. As we find new

Ask Dr. RMF

Dear Dr. RMF, Government IT Security staff work with systems owners to make sure that all systems in the agency have implemented the proper Risk Management Framework (RMF) controls. Organizations have deployed technologies like eMASS, XACTA, and RSA to manage the workflow and documentation for the RMF for their systems. Yet, there is confusion about

NIST Privacy Framework: An Update

By Kathryn Daily, CISSP, CAP, RDRP Back in September 2018, NIST announced their plans to develop a data privacy framework based off their cybersecurity framework that has been extremely successful in both government and private sector. NIST has worked with industry through webinars and workshops and incorporated both public and private sector feedback for the

Security Control Inheritance

By Lon J. Berman CISSP, RDRP CNSSI 4009 defines Security Control Inheritance as “a situation in which an information system or application receives protection from security controls (or portions of security controls) that are developed, implemented, and assessed, authorized, and monitored by entities other than those responsible for the system or application”. The typical example

How Much Information is in a Message?

"How much information is in a message?" Huh??? That sentence, in the context of typical use of those words (information & message), doesn't immediately make sense to most people. Well, I know it didn't make sense to me, at least. So let me try asking it in a seemingly more complicated but different way: "If

NIST 800-37 Rev 2: It’s Official!

By Kathryn Daily, CISSP, RDRP NIST has officially released NIST 800-37 Rev 2 and dubbed it as “RMF 2.0.” The framework has been updated to include both cybersecurity and privacy to be key for an authorization decision. “RMF 2.0 gives federal agencies a very powerful tool to manage both security and privacy risks from a

Powerful but not well understood: Reciprocity, Type Authorization, and Assess Only

By Lon J. Berman CISSP, RDRP All of us who have spent time working with RMF have come to understand just what a time-consuming and resource-intensive process it can be. As bad as that may be, it is made even worse when the same application or system ends up going through the RMF process multiple

IT Dojo Announces Security Control Assessment (SCA) Training Workshop

Training Overview Security Controls Assessment Workshop provides a current and well-developed approach to evaluation and testing of security controls to prove they are functioning correctly in today's IT systems. This course shows you how to evaluate, examine, and test installed security controls in the world of threats and potential breach actions surrounding all industries and

Is RMF Broken? Can it be fixed or is it beyond repair?

By Lon J. Berman CISSP, RDRP Thanks to the work of the Joint Task Force, RMF is now the official information security life cycle process across all three “segments” of the Executive Branch, i.e., DoD, federal civil agencies, and the intelligence community. It’s now been 4 ½ years since DoD officially “adopted” RMF (DoDI 8510.01,

The Newest NIST Framework: The NIST Privacy Framework

By Kathryn Daily, CISSP, CAP, RDRP NIST has announced the development of a Privacy Framework. The framework is needed to ensure the ability to design, operate, or use technologies in ways that are observant of various privacy needs in a progressively connected and complicated environment. It is expected to help manage risk by protecting people’s

NIST 800-171: Confusion and the Protest Docket

By Kathryn Daily, CISSP, RDRP I’m sure by now you’ve at least familiarized yourself with NIST 800- 171, “Protecting Unclassified Information in Nonfederal Information Systems and Organizations.” What wasn’t made clear was how DoD will evaluate a contractor’s System Security Plan (SSP). In May, DoD released draft DoD Guidance for Reviewing System Security Plans and

NIST 800-37 Rev. 2

By Lon J. Berman CISSP, RDRP The National Institute of Standards and Technology (NIST) is in the process of preparing Special Publication (SP) 800-37 Rev 2 for publication. As you may know, NIST SP 800-37 is the publication that defines the Risk Management Framework (RMF) roles, responsibilities and life cycle process. A review of the

NIST Updates RMF to Incorporate Privacy Considerations

Interesting press release just put out stating that NIST is updating the RMF to incorporate privacy considerations. Full release can be found here.

RMF Training Coming Back to Pensacola Florida

From May 7 - 10, 2018, IT Dojo will be bringing RMF for DoD IT training to Pensacola, FL! Our last course that ran there a few months ago was in such high demand that we decided to come back! This instructor-led course will get you up to speed on what to expect as you

IT Dojo Introduces: STIG 101 Training

By Kathryn Daily, CISSP, RDRP NIST 800-53, and specifically Security Control CM-6, requires an organization to a. Establish and document configuration settings for information technology products employed within the information system using [Assignment: organizationdefined security configuration checklists] that reflect the most restrictive mode consistent with operational requirements; b. Implement the configuration settings; c. Identify, document,

RMF and the Defense Security Service (DSS)

By Lon J. Berman, CISSP, RDRP at BAI. The Defense Security Service (DSS) serves as an interface between the government and cleared industry. DSS administers and implements the National Industrial Security Program (NISP) by providing oversight and assistance to cleared contractor facilities to ensure protection of classified information. In short, if your company maintains cleared

NIST 171—What’s That?

By Kathryn Daily, CISSP, RDRP If you heard a whooshing sound on New Years Eve, that was probably the deadline for compliance with NIST 171 flying by. A lot of you might be asking “What is NIST 171?” NIST 171 is a set of requirements documented in the NIST Special Publication 800-171 (Protecting Controlled Unclassified

Is Your System a National Security System (NSS)? and How Does That Affect RMF Efforts?

By Lon J. Berman, CISSP, RDRP By federal law, an information system will be designated as a National Security System (NSS) in accordance with the following definition: The term “national security system” means any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other

RMF: Is It Effective?

By Kathryn Daily, CISSP, RDRP In July 2017, SolarWinds conducted an online survey via Market Connections aimed at approximately 200 federal government IT decision makers and influencers in order to determine challenges faced by IT professionals to prevent security threats, quantify sources and types of IT threats, determine elements that aid successful management of risk,

Continuous Monitoring Today—And Tomorrow

This article was written by Lon Berman, CISSP, RDRP of BAI Information Security Step 6 of the Risk Management Framework (RMF) is entitled “Monitor Security Controls”. Many security professionals would argue it is the most important step, since monitoring is what transforms RMF from yet another “point in time” evaluation to a true life cycle

Security Control Spotlight— Inheritance from a FedRAMP Approved CSP

This article was written by Kathryn M. Daily, CISSP, RDRP of BAI Information Security. In a previous article, security control inheritance from an external system hosted at a departmental or agency data center was discussed. In this article, we are going to discuss inheritance from a FedRAMP Approved Cloud Service Provider (CSP) such as Amazon

NIST SP 800-53 Rev 5—Big Changes Coming?

By Lon Berman, CISSP of BAI Information Security As you probably know, the “catalog” of security controls used in RMF is derived from NIST Special Publication (SP) 800- 53 Rev 4. What you may not know is that NIST is hard at work on SP 800-53 Rev 5. The reaction to this news on the

Top Ten—Things You Should Know about eMASS

By Lon J. Berman, CISSP of BAI Information Security The Enterprise Mission Assurance Support Service, or eMASS, is a web-based Government off-the-shelf (GOTS) solution that automates a broad range of services for comprehensive, fully integrated cybersecurity management, including controls scorecard measurement, dashboard reporting, and the generation of Risk Management Framework (RMF) package reports. If you’re

160 bits …SHAttered!!!

We knew this day was coming. On a long enough timeline, the survival rate for every algorithm drops to zero. Yes, I'm paraphrasing Tyler Durden. It's slightly less amazing than finding a unicorn in the woods and I don't think many will remember where they were and what they were doing on the day they

Security Control Spotlight—Training

By Kathryn M. Daily, CISSP BAI Information Security In this issue we will shine the spotlight on the Awareness and Training (AT) family of security controls. We’ll show you how the controls dictate the types and frequencies of training that organizations must provide. You'll also learn about the extent to which existing DoD publications provide

Top Ten—Documentation Recommendations

By Lon J. Berman, CISSP BAI Information Security Supporting documentation (aka. artifacts) is key to providing evidence of compliance with security controls. Previously in this Newsletter we have spent some time describing the three fundamental classes of RMF documentation, to wit: Policy. Policy documents describe what the organization does to provide for confidentiality, integrity and

In the World I See…

My time in the IT world is closer to three decades than two. And anyone else who has been around half as long can testify to the amount of change that has occurred. It's more than impressive; it's a shock. Across the years I have more than once likened keeping up with technology to treading

Time to Ante Up More Time for Your CCNA

The pool of knowledge required to earn your CCNA continues to get larger. It has become so large that it is no longer coverable in a 1-week training course.

Certification Suckers

Who benefits the most when you get certified? You? Or is it the vendor?

Security Control Spotlight—Contingency Planning

By Kathryn M. Daily, CISSP of BAI Information Security In this issue we will shine the spotlight on the Contingency Planning (CP) family of security controls. First, we’ll show you how the controls dictate the subject areas that need to be addressed in the organization/system’s disaster recovery and business continuity plans. Second, you'll learn how

Top Ten RMF Pitfalls Revisited

By Lon Berman, CISSP of BAI Information Security Like any complex process, RMF is not without its share of potential pitfalls. Now that we have the benefit of some more RMF projects under our belt, we thought it was time for a “revisited edition” of the RMF Top Ten Pitfalls. 10. Assuming system boundaries have

Understanding the Authorization Decision

By Lon Berman, CISSP of BAI Information Security If you ask most system owners about the desired outcome of their RMF efforts, they will readily tell you “we are expecting the Authorizing Official (AO) to sign an Authorization to Operate (ATO) for our system.” But how much do they really know about what goes into

RMF Training in Virginia Beach is Filling up!

Attention information assurance and cyber security professionals in Hampton Roads! IT Dojo is running an RMF for DoD IT training course in the Virginia Beach/Norfolk area July 11 - 14. Seating is limited, but this course is guaranteed to run! We have delivered this course to hundreds of individuals throughout the country and the response

Top Ten—RMF “Lessons Learned”

By Lon J. Berman, CISSP BAI Information Security I recently had the pleasure of consulting for a DoD program that successfully navigated the RMF process and received a full three year Authorization to Operate (ATO). In lieu of … or in addition to … a victory party, the team decided it would be productive to

Enhance Your RMF Training Experience with TrainPlus!

Picture this. You’ve just completed your RMF training with IT Dojo. You spent four days in class learning and doing. So much information and guidance has come your way that at times you felt like you were drinking from a fire hose! Now, at last, you’re sitting in the relative peace and quiet of your

Security Control Baseline “Tabletop Review”

By Lon J. Berman, CISSP at BAI Information Security Let’s take a look at some strategies for reviewing the Security Control Baseline and creating “action plans” for implementation. The “Raw Materials” An effective review starts with the right materials. You’ll need two spreadsheets to work with: Security Controls Assessment Procedures (CCIs) Using the Security Controls

Security Control Spotlight—Inheritance

By Kathryn M. Farrish, CISSP BAI Information Security Security Control Inheritance is one of the most powerful tools available to facilitate the RMF process. Unfortunately, it is not always very well understood, and, as a result, is often misapplied. CNSSI 4009 defines Security Control Inheritance as “a situation in which an information system or application

Learning More About Apple iOS9 MAC Address Randomization

Apple uses a variety of scans for wireless LAN/physical location information. There are Preferred Network Offload (PNO) Scans, Enhanced Preferred Network Offload (ePNO) Scans, Location Scans and Auto Join Scans. Each of these scans, while mostly identical in frame format, are used at different times and for different reasons by the device. In order to

Security Control Spotlight—STIGs and Controls

By Kathryn M. Farrish, CISSP at BAI Inc. One of the primary goals of the RMF life cycle is for a system to achieve and maintain compliance with a baseline of Security Controls in accordance with NIST SP 800-53 and CNSSI 1253. Security controls provide specific safeguards in numerous subject areas (aka. “families”), including access

Security+ CEU Question and Answer

I recently had a client who had a Security+ certification that was about to expire and he asked me a question that I wanted to share with our readers. If my Security+ certification is about to expire, can I just sit in another Security+ course and earn the CEUs that I need in order to

Building A Security Control Baseline “Step-by-Step”

Article By Lon J. Berman, CISSP In the last issue of RMF Today and Tomorrow, we walked through the System Categorization process step-bystep. Now that we’ve categorized our system, let’s take a look at the steps for creating a Security Control Baseline. Step 1: Create Initial Control Set Your System Categorization defines the initial set of

Top Ten—Questions for your Authorizing Official

By Annette Leonard The importance of the Authorizing Official (AO) in the RMF process is self evident. As the individual charged with signing your Authorization to Operate (ATO), the AO is obviously a key player. Ideally, the AO’s role is not limited to that final signature—he/she should be an active participant in the process from

System Scans in eMASS … Think Before You Upload!

By Kathryn M. Farrish, CISSP eMASS, short for Enterprise Mission Assurance Support Service, is a comprehensive tool provided by DoD for managing the RMF life cycle. Among its well-known features and capabilities are generating security control baselines, managing RMF workflow, maintaining a repository of documentation artifacts, accepting system owner provided “self assessment” of security control

The Danger of Transparent Encryption

With all the renewed furor over the government attempting to force Apple to backdoor iOS devices so the FBI can inspect the phone of the San Bernardino terrorists I found myself with a usual set of emotions. I have always been an advocate of limited government involvement in the lives of private citizens (i.e. approaching

The Altruism of IPv6

In this post Colin discusses the slow migration to IPv6. Who will pay for the migration versus who will gain the biggest benefit? It's an altruistic problem.

You Geek? I Geek.

When is the last time you sat down at your desk and really went full-geek on something just because you found it fascinating? No, not because you needed to know it for work or because you wanted to build up your skill set for some future position; I'm talking about full-on burial in a topic

A Somewhat Brief Explanation of Password Entropy

In this post Colin explores password entropy and what it means in terms of password strength.

Wrapped In Python – Edition 6 – Fibonacci Sequence

In this post Colin tackles the self-imposed challenge of figuring out how to generate the Fibonacci Sequence using python (without using Google)

What is STIG Viewer (and why are there two answers)?

By Kathryn M. Farrish, CISSP Security Technical Implementation Guides (STIGs) are published periodically by the Defense Information Systems Agency (DISA). STIGs contain very detailed lists of security settings for commonly used IT system components, such as operating systems, database management systems, web servers, network devices, etc. Compliance with applicable STIGs is one of the key

The Top Ten STIGs

Article by Annette Leonard The Defense Information Systems Agency (DISA) is responsible for developing security guidance for configuring DoD information systems. An extensive collection of Security Technical Implementation Guides (STIGs) is published at http:// iase.disa.mil/stigs/Pages/index.aspx. STIGs contain detailed configuration guidance (settings) for commonly-used software products and other system components. Most of these documents are updated

Security Control Spotlight: A Little Good News?

Article by Kathryn Farrish, CISSP Imagine this dialog between Edward, a System Owner, and Christine, his Information System Security Manager (ISSM): Edward (System Owner):“Now that we’ve completed our System Categorization, have you built the Security Control Baseline for our system?” Christine (ISSM): “Yes, sir, I have. Our system has been categorized as “Moderate -Moderate-Moderate (M-M-M)”.

RMF’s System Categorization: Step by Step

In this blog post Lon Berman, CISSP talks about the sub-steps of the first RMF step, System Categorization. Step 1: Identify Information Types The first and perhaps most important step in the system categorization process is the determination of the “information types” that are stored and processed by the system. So what exactly is an

The Best CBK Domain. And Why.

In this post, Colin offers up his favorite CBK domain and explains why.

Discounted CompTIA Exam Vouchers

We are pleased to announce that we are able to now offer our clients discounted exam vouchers for CompTIA exams. The discounts are anywhere from 8 - 12% off of retail pricing. We can save you money on A+, Network+, Security+, CASP, Server+, Storage+, Project+, Linux+, Mobility+, CDIA+, CTT+, Cloud Essentials, Cloud+, Healthcare IT, and

John Brennan, AOL, and Bruce Schneier Driving Hard Left

I just finished reading Bruce Schneier’s blog entry, titled "The Doxing Trend". Let me start by writing that I am usually a big fan of Mr. Schneier. I look forward to his newsletter and I have tremendous respect for his technical intelligence. But as I read his doxing article I couldn’t help but wonder what

CASP vs CISSP – Let’s Explore

In this post Colin focuses his attention on the CASP and CISSP certifications, weighing the pros and cons of both in order to determine which is the best path.

CISSP Preparation Resources

When it comes to getting your CISSP certification, I have one important word for you: STUDY. Study in the car (preferably not while driving), study at work (taking care to not get fired), study at home, study everywhere you get a free moment. Study before training, study after training. You really cannot study too much

Wrapped In Python – Edition 5 – 3rd Grade Math Tutor

In this post Colin uses python to help give his 3rd grade daughter with some extra math homework ...and helps himself with another way to learn more python.

The Value of Certification

In this post Colin offers an unfiltered perspective on the value of industry certifications. And in the end, why you should bother getting them.

Wrapped In Python – Edition 4 – Primitive Root Finder

A python script to calculate all of the primitive roots for a given prime number.

Wrapped In Python – Edition 3 – Prime Number Verifier

A short python script used to determine if a given number is a prime number.

Wrapped In Python – Edition 2 – Prime Number Generator

A simple python script that will determine every prime number (up to 9,999,9999).

Wrapped In Python – Edition 1 – The Beginning …Again

Intro to a new blog series detailing python code written by Colin as he learns to write it.

Top Ten—Data Breaches that Made the News

By Annette Leonard Many information security incidents are newsworthy, especially when they involve compromise of personal, financial and/or medical information. Here is our “Top Ten” list of data breaches that have made the news over the past few years. While some of these compromises may have resulted from very sophisticated attack methods, others were traceable to basic lapses in good security practices—the very things the

Common Controls and Inheritance

By Kathryn M. Farrish, CISSP Common Controls are security controls whose implementation results in a security capability that is inheritable by multiple information systems (IS). For example, the information systems hosted in a data center will typically inherit numerous security controls from the hosting provider, such as: Physical and environmental security controls Network boundary defense security controls Other inheritance scenarios include agency or departmental-level policies

FAQ: How Comprehensive is your RMF for DoD IT Course?

The most common question we get in regards to our RMF for DoD IT training course is this: How comprehensive is your RMF for DOD IT course? The reason I ask is that the Navy is still trying to wrap their head around RMF and how to integrate it both from an acquisitions and operational

Security Control Spotlight—Privacy Overlay

By Lon J. Berman, CISSP According to NIST Special Publication (SP) 800-53, an overlay is a “fully specified set of security controls, control enhancements and supplemental guidance derived from the application of tailoring guidance to security control baselines”. The intent is to streamline the process of developing a security control set for specific communities of interest. The Committee on National Security Systems (CNSS) website, www.cnss.gov,

System Categorization-Take the Time to Get it Right

By Lon J. Berman, CISSP The story is told of an intern who is asked by his boss to pick up some items from the supply room in the basement. The young man is not sure how to get down there, but, seeing an open door, assumes it is the stairway and steps through. Unfortunately the door turns out to be an

Post Training Support on our RMF classes!

TrainPlus! POST TRAINING SUPPORT RMF education doesn't just stop when the training class is over. That's why we offer TrainPlus!, a RMF Q&A follow-up session. Designed specifically for students who've previously attended an IT Dojo RMF training class, TrainPlus! is delivered via a monthly, 60-minute, conference call at no charge. Whether the training experience has been online, onsite or

Free Ways to Earn CEUs!

You've earned your CISSP or your Security+ certification...now you need to maintain it. No one wants to have to take those beastly exams again! But how do you do that without spending a lot of money? Sure you could take other classes (and will need to to remain relevant, of course), but sometimes there isn't

Information Security Continuous Monitoring Course Date Just Added!

We have just added a course date for the Information Security Continuous Monitoring training that is coming up this fall (September 22 - 24, 2015). Information Security Continuous Monitoring (three days) covers roles and responsibilities, establishment and implementation of the ISCM strategy, analysis and reporting of findings, and program review in accordance with NIST Special Publication

Let’s Talk About ITIL Training

IT Dojo has ITIL Courses Available in Hampton Roads and Beyond! The IT Infrastructure Library® (ITIL®) is a set of best practices for IT service management (ITSM) that focuses on aligning IT services with the needs of business. ITIL is published as a series of five core publications, each covering an ITSM lifecycle stage. ITIL

Why NIST’s Free Online RMF Training is Not Enough

As many of you are already aware, NIST offers free online Risk Management Framework training as a resource on their website. While this is a great resource containing excellent information and should be included in your learning plan, it is not enough when it comes to preparing yourself and your staff for the transition from DIACAP

What Are CCIs and Why Should I Care About Them?

By Kathryn M. Farrish, CISSP One of the more recent information security innovations is the Control Correlation Identifier, or CCI. Each CCI provides a standard identifier and description for “singular, actionable statements” that comprise a security control or security best practice. The purpose of CCIs is to allow a high level statement made in a

Security Control Spotlight—The PM Family

By Lon J. Berman, CISSP The Beatles were comprised of how many musicians? Easy, right? They were called the “Fab Four”, so there were definitely 4. Now Google “the fifth Beatle” and see what you get. Ditto for “sixth sense”. When I eat at a Thai restaurant and the waitress asks how hot I want

Getting Off to A Good Start with Your RMF Transition

This is a top ten list of things that will help you at the beginning of your transition from DIACAP to RMF.

RMF Transition—What do I Really Need to Know?

By Lon J. Berman, CISSP It’s hard to believe it’s been a whole year since the publication of DoD Instruction (DoDI) 8510.01 in March of 2014, which officially began the transition from the DIACAP process and IA Controls to the Risk Management Framework (RMF) and NIST Security Controls. While there are isolated pockets of progress

Installing pyrit with GPU Support on OS X

In this post Colin walks you through getting Nvidia CUDA support enabled on your OS X device and illustrates the basics of how to use it with pyrit and cpyrit.

Spotlight: Information Security Continuous Monitoring

By Lon Berman, CISSP No longer just a technical issue, instead a strategic program to manage cybersecurity risk. Targeted cyber attacks are a strategic organizational problem. Cyber attackers are more sophisticated than ever before, and it has become vitally important to understand how to manage risk and implement a continuous monitoring program. More than just

Nothing Neutral About Net Neutrality

In the article, Colin offers his opinion on Net Neutrality.

Security Control Spotlight—By the Numbers

By Lon J. Berman, CISSP of BAI, Inc. In this issue’s “Spotlight”, we’re not going to focus on any specific controls or families, but rather on a comparison of RMF controls and DIACAP controls. The majority of DoD information systems are currently categorized under DIACAP as “MAC II Sensitive” or “MAC III Sensitive”. These categorizations

Top Ten—Sources of RMF Policy and Guidance

By Annette Leonard of BAI, Inc. RMF-related policies and guidance come from a plethora of sources within the seemingly-convoluted federal landscape. We believe a good understanding of these sources will be helpful as you move forward in your RMF implementation. Here, then is our “Top Ten” list of RMF policy and guidance providers. 10. US

Significant Update to NIST SP 800-53A

By Kathryn M. Farrish, CISSP of BAI, Inc. At long last, NIST has finally released a draft copy of the updated version of SP 800-53A, entitled Assessing Security and Privacy Controls in Federal Information Systems and Organizations. This is an important document in the RMF “document library” because it contains the “how to” for assessing

RMF Transition—What is the Real Timeline?

By Lon Berman of BAI, Inc. Now that RMF is official DoD policy, every DoD system owner needs to begin planning their “transition” from DIACAP. In order to plan and execute the transition, system owners need the answers to three basic questions: What does the transition process entail? When do I need to begin the

Spotlight: Transitioning to the Risk Management Framework (RMF)

With the publication of revised DoD Instruction 8510.01, adoption of the Risk Management Framework (RMF) by DoD has begun. DoD programs are busy planning and implementing strategies for transitioning from DIACAP to "RMF for DoD IT". What Efforts are Taking Place in Support of the RMF Transition? Tier 1: DoD Enterprise RMF Knowledge Service -

OSX Airport CLI Tool - Not Just for Airport APs

In this Post Colin explores the seldom mentioned OSX CLI airport utility and many of its WLAN configuration and and information gathering features.

RMF Training: Better Price. Better Delivery. Best Results.

The DoD has announced that RMF for DoD IT will supercede the current DIACAP requirements. Revised DoD IA policies and procedures will not be published until later this year and there’s sure to be a “phase in” period. Why should your organization be concerned about preparing for the upcoming RMF transition now? Get Familiarized with

Security Control Spotlight— Organization-Defined Parameters

By Kathryn M. Farrish, CISSP BAI Consulting Under RMF, NIST SP 800-53 is the primary source for security controls. If we compare these controls to the DoDI 8500.2 IA controls used in DIACAP, several obvious differences can be seen. Most notable among these differences is the fact that many of the NIST controls are not

Top Ten—Ensuring a Smooth Transition to RMF

By Lon J. Berman, CISSP BAI Consulting Now that DoD has “officially” begun its adoption of “RMF for DoD IT”, let’s take a look at some of the things your organization can do to ensure a smooth transition. 10. Publications. Organizations should ensure they are using the latest copies of relevant publications. This includes not

DoD Programs “Gear Up” for Transition to RMF

By Lon J. Berman, CISSP BAI Consulting With the publication of revised DoD Instruction 8510.01, adoption of the Risk Management Framework (RMF) by DoD is now official. DoD programs big and small have gotten busy planning their strategies for transitioning from DIACAP to “RMF for DoD IT”. Let’s take a look at some of the

CISSP Success!

We just wanted to share this great message we just got from a client that sat in our CISSP training a few months ago! I would like to thank both of you. I have now taken Security+ and the CISSP classes from you and will highly recommend your site to anyone that seeks improvement in

iPad File Download and Upload Solutions

Using an iPad's unlimited data plan to download from the Internet and upload to your PC. A great solution for those who don't have unlimited bandwidth at home.

Offensive Wifi Gear Has Started to Arrive!

We are getting excited about our upcoming Offensive Wifi and Mitigation Techniques class. Gear has started to arrive! Check out these Mark V Pineapples that showed up today! This class will be using these and other tools to demonstrate wifi attacks and how to prevent against them. If you would like more information, please give

RMF Transition Timeline Infographic

IT Dojo offers a comprehensive course on the transition from DIACAP to RMF. Please take a look at our RMF training courses here. Here is a link to a great book on RMF that we highly recommend. A ton of other information can be found on the NIST web site.

What are the Steps in the Risk Management Framework Process?

Cloud Security and FedRAMP. Are you Ready for it?

A deadline for federal agencies to adhere to the government’s baseline cloud security standards and changes to the standards themselves are coming up very soon. The deadline for agencies to have their existing cloud computing solutions assessed against the Federal Risk and Authorization Management Program, or FedRAMP is June 5, 2014 Read more about this

DoD (Finally) Begins Transition to RMF

By Lon J. Berman, CISSP BAI Consulting The wait is over! RIP DIACAP!! At long last, DoD has announced the start of transition from the legacy DIACAP Certification and Accreditation (C&A) Program to the Risk Management Framework (RMF). This transition is part of a broader effort to bring all Executive Branch departments and agencies …

Top 10 Things that Will Be Staying the Same with RMF

By Lon J. Berman, CISSP BAI Consulting As DoD begins its transition from DIACAP to Risk Management Framework for DoD IT, everyone is naturally focused on all the things that will be changing—everything from terminology to documentation to security controls. Thankfully, not everything is changing! We thought it would be interesting to take a look

RMF Documents and Resources

For your convenience, ITdojo has assembled the following collection of RMF-related government publications. Please note these are UNCLASSIFIED documents with no restrictions on usage or distribution. Laws and Executive Branch Policies Federal Information Security Management Act (FISMA) OMB Circular A-130 Appendix III (Security of Federal Information Systems) Federal Information Processing Standard (FIPS) Publications FIPS 199

Top Ten—What’s “new” in RMF for DoD IT?

By Lon J. Berman, CISSP BAI Consulting Now that DoD has “officially” begun its adoption of RMF, let’s take a look at some of the things that are “new”! 10. Cybersecurity. The word “Cybersecurity” has been part of the government IT security discussion for several years, going back to a Presidential Directive in 2008. DoD has now adopted the term Cybersecurity in

Continuous Monitoring—It’s Not (Just) About The Tools

by Annette Leonard BAI Consulting Continuous Monitoring has long been recognized as a critical element in maintaining a strong security posture for any IT system. In spite of this, the risk management processes used in most federal agencies have traditionally been centered around mountains of paperwork, along with "point-in-time" assessments and approvals. With the ascension

DIACAP says, "So Long"

DoD replaces DIACAP with NIST-based RMF standard.

DoD Transition to RMF Imminent—Will You Be Ready?

By Lon J. Berman, CISSP For quite some time, it’s been well known that DoD would be making a transition from the legacy DIACAP Certification and Accreditation (C&A) Program to the Risk Management Framework (RMF). This transition is part of a broader effort to bring all Executive Branch departments and agencies … including DoD, the intelligence community and all “civil” departments/agencies … into a

Using the Percent Sign in Python

In this article Colin discusses the use of the percent sign in python.

A Brief Explanation of IPv6 Address Types

In the article, Colin briefly describes the address types seen in IPv6: unicast, multicast, and anycast.

Am I Using IPv6?

Quick and easy web sites to visit to determine if you are IPv6 capable on the Internet.

Forcing ssh to use IPv6

How to force the use of IPv6 using ssh from a terminal.

v6 Vertex #1: Viewing IPv6 Neighbors on Apple OS X

ITdojo's v6 Vertex - Quick Tips & Tricks for IPv6 Users - Using the command line to view neighbors on Apple OS X devices

Is Your Post 2011 Security+ Cert About to Expire? Get CE Credits Now!

As many of you know, if you received your Security+ certification after 2011, you are not eligible for lifetime Security+ status. Before that you were grandfathered in, but if your is after 2011 you are out of luck. No every 3 years you must renew your certification by either retaking the exam, or by completing

Why Hasn’t Everyone Moved To IPv6?

We spotted this interesting IPv6 article this morning written by Angus Kidman at Lifehacker and wanted to share it with you. Here's an excerpt: "We’ve known for decades that the available pool of IPv4 address was eventually going to dry up, but despite numerous warnings usage of its successor IPv6 is still minimal. Why haven’t

There is No Substitute for an Instructor

Most will agree that there is no substitute for instructor-led classroom training. The interaction and dialogue between teacher and student is tough to beat. But tight budgets and even tighter business needs can make it difficult to break away from the office to attend training. You need to be better at your job but you’re

Pushing Firewall Admins into an ICMPv6 Frame of Mind

In this post Colin discusses issues the Path MTU discovery (PMTUD) and its implications on networking with IPv6.

On the Evolution of Ubuntu

Ubuntu 12.10 is set to release with controversial new features that have some Ubuntu users upset. In this post, Colin offers some comments on his perspective.

SSH Using Link-Local IPv6 Addresses

In this post Colin reviews how to use link local IPv6 addresses to establish ssh connections to remote hosts.

The 600-lb Gorilla Sitting on the Shoulders of IPv6

In this post Colin addresses what he sees as the single biggest obstacle to the migration of the world to IPv6.

A Glimpse Into the Future of IPv6 at Home

In this post Colin give a brief overview of prefix delegation, one of the coming features of most residential IPv6 deployments.

Deprecate, Deprecate, Deprecate

Those actively involved in the journey to IPv6 as the native transport encounter plenty of new terms and technology. One unexpected term stands out for Colin.

Know Thy IPv6 Neighbor

In this post Colin reviews the items kept in the IPv6 neighbor cache and how to view the cache on Windows, Linux and Mac OSX systems.

Resolver Cache - Linux vs Windows

In this post Colin explores some of the differences in DNS behavior between Windows and Linux systems.

Chief Information Officers Council – Roadmap Toward IPv6 Adoption for the Federal Government

Just last week (July 12, 2012), the Chief Information Officers Council released this updated version of the Roadmap Toward IPv6 Adoption for the Federal Government to help with the upcoming deadlines for September of 2012 and September 2014. It highlights the history as well as the government's vision for IPv6. To read the original article

Security Through Obscurity

The effectiveness of Security through Obscurity is closely related to the knowledge (or lack thereof) of the attacker. If someone is unaware of how a particular technology works, the data is obscured by the nature of the technology. Once some understanding is had by your adversary, however, the security vanishes. Some examples are: 1. Not

What DoD Directive 8570.01 is All About and What It Means to You

Directive 8570.01 is an initiative that sets out to provide guidance and procedures for training, certification, and management of the Department of Defense (DoD) workforce that are in positions related to Information Assurance. The agencies this directive is applicable to are the Office of the Secretary of Defense (OSD), the Military Departments, the Chairman of

/64 or /126 Silliness

A comment on the silliness of using /126 IPv6 prefixes for for P2P links.

June 8th is World IPv6 Day

June 8th is World IPv6 Day

A Life Without Network Address Translation (NAT)

IPv6 means a world without NAT. In this post Colin attempts to help long-term IPv4 NAT users understand why everything is going to be just fine.

Pv6 Means Never Again Having to Wonder

In this post Colin discusses how to give every node in your enterprise the exact same default router IPv6 address and have it all still work.

In the World I See…

I wrote this post several years ago. By writing it I was trying to get people to begin to think about how the size of the IPv6 address space, when combined with RFID technologies, was going to change everything about how they manage their lives. I wrote this way before NetFlix began streaming content, before

The Debate Surrounding Section 6.5.4.1

The IANA (Internet Assigned Number Authority) distributes IPv6 address to RIR's (Regional Internet Registry's) around the world. At the moment there are five RIR's and each of them is responsible for allocating IPv6 address space to ISP's (Internet Service Providers) and, in some cases, End-User organizations. Once a block of addresses is allocated to an

On the Practical Feasibility of Ping Sweeping IPv6 Networks

Exploring the practical feasibility of ping sweeping IPv6 networks. Includes a spreadsheet for determining how long it will take to sweep your own network.

Basic IPv6 Resolver Configuration in Ubuntu

Configuring Ubuntu's (any Linux distro, really) resolv.conf file with an IPv6 DNS server so you can natively query IPv6 DNS servers.

The Sound of IPv6 Inevitability

The need to migrate to IPv6 is imminent. The IPv4 address space is exhausted. Corporate America can no longer ignore the signs; it's time to get moving.

Delivering DNS via IPv6 Router Advertisements

A brief introduction to the newly created RFC that allows routers to provide DNS server information via Router Advertisements (RA).

If Each IPv6 Address Was a Second in Time

In an earlier post I offered some perspective on just how big the 128-bit IPv6 address space is. The ridiculousness of the number of addresses offers plenty of opportunity for levity. Earlier today I was thinking about what other ways I could show the size of the address space in a way that was meaningful.

IPv6 Addresses and UNC Path Names – Overcoming Illegal

The beloved UNC path name, familiar to all who administer Microsoft. After all these years there is something comfortable and familiar in the simple act of cracking open open that run line and busting out a pair of backslashes followed by the name or IP address to which I want to connect. Simple. Easy. Classic.

Link-Local Addressing – So Much More Than FE80

When discussing IPv6 addresses folks are often quick to say, "FE80 ...that's link-local." And it's true. The prefix FE80::/10 is reserved for link-local IPv6 addressing. But a lot of people overlook the fact that the 10-bit prefix only covers two of the four bits represented by the third character in the address. The 'F' and

So Just How Many is 340 Undecillion?

By now most of us know that the IPv6 address space is 128-bits. That's 96-bits larger than the 32-bit IPv4 address space. By now most of us also know that the IPv4 address space has (on paper) 4,294,967,265 possible address. So just how big is the IPv6 address space? Well, it's 2128 (2 raised to

What You dig and How You dig It

The Domain Internet Groper, or dig, as most of us know it, is considered by pretty much everybody in the 'nix community to be the replacement to nslookup. And I have long been madly in like with it. Not sure why, though. nslookup has never been a disappointment. Maybe it's because dig is newer and