Christopher O'Malley

#BoozAllen is helping agencies meet zero trust mandates. Hear Imran Umar on the CyberWire Daily podcast discuss DISA’s Thunderdome solution, built by #BoozAllen. Listen to the podcast: https://lnkd.in/emdYyZmj

1

Re-sharing as I believe this story got buried, at least in the #security community, with the double-whammy CyberArk / Black Hat news rush. While something as vaguely 19th-century as a railroad merger may seem antiquated, this has very real consequences for modern infrastructure. 𝑻𝒉𝒊𝒓𝒕𝒚-𝒕𝒘𝒐 𝒕𝒉𝒐𝒖𝒔𝒂𝒏𝒅 𝒎𝒊𝒍𝒆𝒔 of rights-of-way across the Western United States are being leased, at least in some portion, to the largest telecom providers in the country for running fiber optic cable. In other words, while the railroad may not own your ISP, they own the land your ISP leases to bring you the internet. A merger of this size and scope brings even more land and more easements under the control of one entity. As technology pundits debate the pros and cons of consolidation across cybersecurity and software development, this is certainly a story worth following.

4

1 Comment

The Megatrends report is always interesting. I’m sure it will be even more insightful to hear the discussion with Steve Van Till. You won’t want to miss this!

3

Why open, cross discipline #Cyber events matter... The clip below from our Holmesglen panel with Richard Magalad IRAP CISM MACS Cyber, Chantelle Ralevska, Jamie Wiggins and yours truly. “Cyber isn’t an IT silo anymore, it’s everyone’s problem. The best defences come from mixing technologists, ops, comms and fresh student voices in the same room.” 5 lessons from the session/video 🧊 Break the echo chamber Invite HR, finance and comms to the cyber table, their questions expose blind spots we miss. 🧊 Teach why, not just how When staff understand the attacker’s goal, password advice finally sticks. 🧊 Soft skills scale hard tech Smart tools are useless without people who can negotiate an incident at 2 am. 🧊 Map lessons to business outcomes Show how a breach kills revenue and trust, the board listens. 🧊 Students need networks, not just grades A handshake often lands the first security role faster than another cert. Watch the clip to hear the panel hammer these points with real stories. Big thanks to Holmesglen for the platform and to an audience that asked the tough questions. Reciprocity... share knowledge freely and the industry lifts together! 👉 Keen to know which point hits hardest for your organisation right now? Drop a quick comment below...

51

2 Comments

Having spent a lot of time with security leaders in mission-critical environments, the pushback on agent-based solutions is real — performance degradation and stability risks aren't acceptable when the stakes are this high. What we've built at Sandfly Security was designed specifically for these constraints, and partnering with Carahsoft to get it in front of the right government and critical infrastructure teams is a huge step forward.

13

A HPSCI member delivered a big warning in an opinion piece a couple of weeks ago: the U.S. intelligence community is at risk of falling behind if it doesn’t elevate Open-Source Intelligence to a core mission. Rep. Greg Steube’s “U.S. Intelligence Is Sitting Idly By” makes clear how some in the community regard OSINT vs. more sensitive (and expensive) methods: 📣 “Right now, there is a belief that top-secret and compartmented is somehow better or more reliable than open source, but that is plain wrong.” Here’s what came to mind as I read, and why I believe PAI, managed attribution, and broader open-source tradecraft need to be at the heart of every intelligence mission: 🔹 PAI collection matters everywhere: Even if someone isn’t a dedicated OSINT practitioner, collecting from open sources is essential. The tradecraft around attribution and provenance can’t be half-baked. 🔹 Tradecraft like managed attribution is mission-vital, not optional. Without it, OSINT or PAI can become unreliable or, worse, a liability. 🔹 Within the community, there’s ongoing debate: Who should be responsible for collecting open source data or PAI? Dedicated OSINT units? All-source analysts? A hybrid model (eg, non-OSINTers leveraging OSINT tradecraft)? If we don’t adapt, we aren’t just losing efficiency-- we’re losing strategic advantage. National security depends on this shift. Special thanks to colleague Abel Vandegrift for forwarding this along to me: https://lnkd.in/eNueygQ5 #OSINT #PAI #ManagedAttribution #IntelligenceCommunity #NatSec #Tradecraft #OpenSource #CyberThreats #Policy #InformationAdvantage

14

Vendors Must Provide AI SBOMs. 📝 The new joint CISA guidance emphasizes that AI security is a life cycle problem. Critical infrastructure owners must assess risks across four key stages: Secure Design, Secure Procurement, Secure Deployment, and Secure Operation/Maintenance. 𝗪𝗵𝘆 𝗶𝘁 𝗺𝗮𝘁𝘁𝗲𝗿𝘀: Owners must demand clear transparency and strong security commitments from vendors about how AI is embedded in their products. This includes negotiating contracts that mandate a Software Bill of Materials #SBOM and visibility into the supply chain for the models they use. Reliance on opaque models embedded directly in safety-critical loops is deemed unacceptable. 𝗧𝗮𝗸𝗲 𝗔𝘄𝗮𝘆: Governance requires evidence, not just trust. NetRise enables partners to enforce this CISA mandate by analyzing the compiled software of OT components to generate the verifiable SBOMs and component integrity data required from vendors. 👀 Read more in comments:👇 https://lnkd.in/gK4DuGfe

6