Rachel Bondi

🔐 #ICS systems are more connected—and more at risk—than ever. In Part 2 of this blog series, SANS Instructor 🛡🏭 Dean Parsons 🏭🛡 explores how role-based awareness training can be your strongest line of defense. Read the blog → https://lnkd.in/gxhYT_qx

11

1 Comment

Protecting CUI, does it really matter? APT33 didn’t randomly stumble into the MQ-9 Reaper supply chain ecosystem — they targeted it by design. The intrusion patterns, tradecraft, and strategic objectives of APT33 align directly with the U.S. defense supply chain that develops, sustains, and supports MQ-9 Reaper capabilities. Sound on! Here’s the hard truth: 👉 The overwhelming majority of these compromises should never have succeeded. Nearly every stage of the APT33 kill chain — initial access, malware execution, lateral movement, privilege escalation, and data exfiltration — maps cleanly to controls that have been required since 2017 under NIST SP 800-171 Rev. 2 and DFARS 252.204-7012. 👉 If these controls had been fully and correctly implemented, most of APT33’s operations against the MQ-9 supply chain would have been prevented or materially disrupted. For more than a decade, cybersecurity teams at FireEye/Mandiant, Dragos, PwC, and Microsoft MSTIC have documented that APT33’s top espionage priority is aerospace and military aviation. Their targeting consistently includes: • Aerospace engineering • Defense manufacturing • UAV, aviation, and propulsion suppliers • Contractors with access to export-controlled technical data • Organizations supporting Middle Eastern operators of U.S. UAVs That profile perfectly overlaps with the MQ-9 supply chain: ✔ Aerostructures ✔ Turboprop engine and integration support ✔ Sensor and payload development ✔ C2, SATCOM, and datalink systems ✔ Flight-control and autopilot software ✔ Maintenance, repair, and sustainment operations APT33’s intrusion toolkit tells the same story - Shamoon, StoneDrill, ALFASHELL phishing, DropShot loaders, and credential-harvesting campaigns have all been deployed against Tier-2 and Tier-3 suppliers contributing directly to UAV and ISR programs like the MQ-9. CUI is not abstract. DoD Instruction 5230.24 tells us - engineering data, subsystem specs, control surfaces, software, and integration details that enable foreign adversaries to shortcut decades of R&D — and deploy our own capabilities against us. Protecting CUI is protecting national security. And the stakes have never been clearer. #ProtectCUI CUIsupply.com #DoDCIO #CMMC

1

The United States Department of Defense is seeking innovative solutions to combat illicit maritime activity and protect critical infrastructure — from drug trafficking and piracy to illegal fishing. Read full story: https://lnkd.in/eKMiwaAn --- #GovConNews #MaritimeSecurity #DoD

2

The National Institute of Public Safety (NIPS) has unveiled a new series of BSIS-certified training programs, designed to help California security professionals meet licensing requirements and enhance operational readiness. https://hubs.li/Q03xY3zY0

🔒 For defense agencies, compliance isn’t optional — it’s mission-critical. This agency modernized with Clovity + Atlassian, achieving: 🔹45% faster compliance audit readiness 🔹Automated approval workflows 🔹Centralized, secure data access 🔹Real-time dashboards for oversight 👉 Discover how mission-critical compliance was achieved without slowing down operations. #Defense #Compliance #DoD #Atlassian #Clovity

8

1 Comment

In “The End of Battlefield Secrets: Addressing the OSINT Gap in U.S. Special Operations,” Jared Martin describes a new operating reality defined by two forces. First is “environmental transparency,” where civilian devices, social media, drones, and commercial sensors continuously expose activity. Second is “information confrontation,” where adversaries exploit that visibility to shape perception and disrupt decision cycles before forces can act. (Small Wars Journal) A core takeaway from Ukraine is that open sources can drive tempo. The article notes how Ukrainian forces used open imagery and social reporting to identify targets and generate action faster than traditional validation pipelines, and warns that treating OSINT as secondary risks surrendering momentum to adversaries who treat it as a primary weapon. (Small Wars Journal) So why the gap inside SOF? The author points to uneven operational and tactical integration, cultural bias toward classified methods as the default, and the reality that OSINT often appears only when someone asks for it, rather than being built into the system. (Small Wars Journal) The recommendations are practical and specific: • Build a theater level OSINT fusion cell that coordinates collection and synchronizes with classified ISR. (Small Wars Journal) • Embed OSINT analysts with SOF teams to support planning and execution and to connect teams to the fusion cell. (Small Wars Journal) • Shift from ad hoc requests to persistent OSINT analysis across planning, movement, execution, and assessment. (Small Wars Journal) • Train beyond tools, including disinformation detection, interpreting public sentiment, and acting under ambiguity. (Small Wars Journal) • Delegate authority so open source driven insights can be acted on rapidly, and include OSINT integration in readiness assessments. (Small Wars Journal) • The closing point is blunt and worth repeating: in an era of mass transparency, SOF cannot wait for classified confirmation of what the world already knows. (Small Wars Journal) Link to Article: https://lnkd.in/ePjQuSFT #OSINT #SpecialOperations #SOF #MilitaryIntelligence #InformationEnvironment #Readiness #NationalSecurity

1