Bruce Rosenthal

Orbital Integrity: The Next Cyber Frontier The next great battlefield is not in our data centers or cloud tenants. It is orbiting silently above our heads. A single satellite breach could destabilize economies as severely as an oil embargo. The question is not if this frontier will be contested, but whether we will be prepared. Satellites are no longer just military or scientific assets. They are the backbone of modern life. Energy grids, navigation, logistics, finance, agriculture, and global communications all rely on orbital infrastructure. And yet, the security conversation around them is barely beginning. We have hardened banks, utilities, and networks, but what about the constellations in low Earth orbit carrying the digital heartbeat of entire nations? Most boardrooms do not see satellites as their problem. They belong to space agencies, governments, or private launch companies. That is the illusion. In reality, if orbital sovereignty is breached, entire industries will be dragged into the fallout. We already witnessed the impact of a ground-based cyberattack against satellite infrastructure during the Ukraine war. That was only a glimpse. I believe the next pillar of cybersecurity must be Orbital Integrity. This means ensuring sovereign satellite infrastructure, orbital mesh networks, and exo-atmospheric systems remain secure, resilient, and beyond compromise. It demands three urgent commitments: Orbital Mesh Resilience: No single node should collapse the chain. ExoNet Defense Operations: Extend zero trust principles into orbital networks. AEGIS Systems: Astral Engagement and Grounded Intelligence, a new layer of monitoring and rapid response for space-based assets. This is not science fiction. It is a blind spot. We are moving into a world where a satellite outage could trigger market collapse, disrupt power distribution, or ground entire fleets. Boards that fail to see this horizon will be caught unprepared when the first true orbital breach occurs. Orbital Integrity is not optional. It is the next battlefield of trust, sovereignty, and continuity.

15

Another cyber attack overseas that U.S.-based power utilities need to talk about At the end of December, Russia‑linked groups associated with the GRU attempted to disrupt power delivery in Poland by targeting the communication links between renewable generation sites and the operators who manage them during peak winter stress. Instead of using tailored malware against a transmission substation or control center, they went after the communication layers carrying the telemetry data that operators rely upon for visibility and control. By cutting off that information across many small DER sites at once, the attackers increased the risk of frequency disturbances and potential load shedding during peak cold‑weather demand. Had the attack succeeded, nearly 500,000 people could have lost power and heat in extreme cold. As DER penetration grows in the US power grid, the risks are expanding, and we all must evolve with them. This isn’t just a cybersecurity problem. It requires a system‑wide, consequence‑driven approach that considers how the grid actually operates, including the transport communication layers, the configuration of distribution‑level assets, and the engineering controls that keep power flowing safely even when parts of the digital environment are compromised. At 1898 & Co. we can help you develop and implement strategies and controls that address these risks in practical, operations‑focused ways. The first step is to start asking focused questions: - How do your remote DER sites function if communications fail? - What security and operational controls govern your sites, and can they hold up to this type of scenario? - What procedures and protocols are in place to manage an attack that targets operator visibility rather than compromising the site equipment itself? These questions aren't theoretical. They should now be part of responsible grid operations in a more distributed, interconnected, digitally controlled energy system. I’ll be at #DTECH2026 in San Diego next week at the Burns & McDonnell Booth 1419. Stop by if you’d like to talk about what this means for your system and how to prepare. #gridoperations #DER #reliability #resilience #energysecurity Reuters: https://lnkd.in/eA6YQCvW Polskie Radio: https://lnkd.in/eg47fTah

43

1 Comment

Yes, OT threats are real, even if we don’t always see them publicly. Recent incidents like JLR and airport disruptions are reminders, but much more happens behind the scenes. As Rob said, those directly involved in incident response and threat intelligence see the reality every day, even if it’s not in the headlines. Now being part of the CPX, where we are working with the #CyberSecurityCouncil and partners to build the National OT SOC in the UAE. It’s about giving the nation visibility into OT threats and the ability to respond effectively and serving as a trusted advisor on OT cybersecurity. Ignoring these threats until they become visible can have real consequences. That’s why continuing to share insights, build resilience, and strengthen defenses together is so important.

40

CISA just told federal agencies to remove end-of-support edge devices from their networks. Firewalls. VPNs. Routers. Anything unsupported and exposed. Good! But here’s the real question, what happens between now and replacement? - Procurement takes months. - ATO cycles take longer. - Production environments cannot always swap hardware overnight. Let's be honest, Inventory is not control. Policy is not containment. If a vulnerable edge device is still reachable, it is still an entry point. The stronger question is not: “Is it patched?” It is: “Is it reachable right now?” There is only one way to truly eliminate exposure during transition windows. Physically remove reachability. If you are navigating BOD 26-02 and need a way to eliminate exposure immediately while replacement plans catch up, message me.

19

1 Comment

Defense contractors are rushing to adopt AI. Then they hit the compliance wall… DCAA wants evidence of decision rationale. FAR/DFARS requires audit trails for everything. CMMC 2.0 demands continuous monitoring. And most AI governance frameworks aren’t built for this. NIST AI RMF is voluntary. ISO 42001 is industry-agnostic. EU AI Act doesn’t apply to most US contractors. But federal auditors don’t care about frameworks. They care about evidence. Can you prove who approved model deployment? Can you document training data provenance? Can you show how decisions were validated? If the answer is “we have a responsible AI policy,” that’s not enough. GovCon AI (and other highly regulated industries) governance requires infrastructure, not just intent. Decision logging at the model level. Audit trails that persist beyond employee tenure. Evidence assembly that’s continuous, not point-in-time. The contractors getting AI approved are the ones with the most defensible documentation. When DCAA asks “how did you validate this decision?” the answer can’t be “our data scientist reviewed it.” It needs to be… “Here’s the documented validation process, the results, the approval chain, and the evidence.” For GovCon, infrastructure is what survives audits. #AIGovernance #SystemsThinking #OperationalExcellence #SoftwareDevelopment #Enterprise #govcon #kortex #kortexlabs

1

DFARS 7012 requires contractors to implement NIST SP 800-171 to protect Covered Defense Information (CDI). DFARS 7019/7020 requires contractors to perform a basic assurance self-assessment and submit a score to SPRS that is within 3 years of contract award. DFARS 7021 specifies the CMMC level required to be awarded a DoD contract. CMMC levels require either self-assessment or third-party assessment. When making the determination of the level required for a contract, there is a memo that outlines the process that must be followed by the DoD program manager to obtain a waiver to "CMMC assessment requirements" for that contract. "Program Managers and requiring activities should identify information security requirements for the types of information most likely to be associated with the planned contract effort. When market research indicates that including a CMMC assessment requirement may impede ability to generate robust competition or delay delivery of mission critical capabilities, the SAE, CAE, or DAE may approve requests to waive inclusion of CMMC assessment requirements. SAEs and CAEs must carefully weigh the risk of potential loss of CUI associated with mission critical capabilities before granting a waiver." Level 1 - "There are no circumstances likely to warrant approval of requests to waive CMMC Level 1 requirements." Level 2 - "In rare circumstances. such as when seeking competition from non-traditional DoD sources. waivers may be warranted for CMMC Level 2 third-party assessment requirements. Such waivers are not appropriate for contracts requiring performance by a cleared defense contractor. Approved waivers on a class basis must include a planned expiration date and guidance for requiring CMMC certification in subsequent solicitations." Level 3 - "In rare circumstances, waivers may be warranted for CMMC Level 3 third-party assessment requirements: such waivers, however, are not appropriate for contracts or work statements requiring access to both unclassified and classified DoD information." Full memo on the process found here, starting on page 6: https://lnkd.in/eeBCW53n #cmmc #dib #dfars

58

12 Comments

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

DOJ, CISA warn of Russia-linked attacks targeting meat processing plants, nuclear regulatory entities and other critical infrastructure https://lnkd.in/gMCmZUUQ U.S. agencies warned critical infrastructure organizations this week of attacks launched by multiple Russian groups backed financially by the country’s government. The Cybersecurity and Infrastructure Security Agency (CISA), alongside several other U.S. and international agencies, released an advisory covering the cyberattacks launched by CyberArmyofRussia_Reborn (CARR), NoName057(16) and several related groups. The advisory covers the tactics the groups have used since 2022 to target the water, energy and food sectors. The advisory said the groups have a “low level” of technical knowledge and frequently misunderstand the processes they aim to disrupt. The group’s actions often result in “haphazard attacks where actors intend to cause physical damage but cannot accurately anticipate actual impact.”

1

CISA has published a draft of the new CISA SBOM Minimum Elements! The 2021 NTIA Minimum Elements were an important step to help create a common specification of what should be in an SBOM. CISA is proposing an updated, clarified version that can be aligned with existing tools and support use cases. They are actively seeking feedback, so please share, review, and send them your thoughts! https://lnkd.in/eRm_zxT2

201

13 Comments

The DoE has a plan to improve the cybersecurity of the entire energy sector with no money, no people and no regulations. Let me know how that turns out. https://lnkd.in/gZbuKN5h

4

Nuclear power needed for localized private use will drive need for safe and secure technology adoption and connectivity. Lots to think about when building nuclear powered data center infrastructure... Keep Cybersecurity as a requirement across all work streams and vendor requirements as well as in your budgets. https://lnkd.in/eURqSz7K

6

1 Comment