Katie Arrington, chief information security officer at the office of assistant secretary of defense for acquisition and a 2020 Wash100 Award winner, said the requirements and other elements of the Cybersecurity Maturity Model Certification program could still change as the Department of Defense (DoD) assesses the public comments submitted through the end of November, Nextgov reported Wednesday.

An interim CMMC final rule will take effect Dec. 1 and Arrington said a final rule could be released by February.

“The level three in the CMMC is the 110 controls in the NIST,” Arrington said. “Right now it has 20 additional controls added to it. We’re open to public comment period. So if any of you have any thoughts on those additional 20 controls, please, before November 30, you have to go in and register and submit those.”  

Although she expects about 0.06 percent of contractors will need to comply with the requirements at the very top of the five-tier CMMC program, Arrington said she thinks those would be “the biggest conversation pieces that we'll be having over the next six months.”

“We have to be judicious with our budgets,” she added.

Arrington will serve as the keynote speaker at the Potomac Officers Club’s Fall 2020 CMMC Forum on Nov. 17th. To register for the  Fall CMMC Forum on November 17th, as well as view upcoming events, visit Potomac Officers Club’s Event Page.

During the forum, you will hear from additional federal and industry leaders who will discuss the requirements and priorities of implementing the certification, including scoping of CMMC assessments, supply chain impacts and C3PAOs. 

Dr. Joseph Evans, principal director for 5G within the office of the undersecretary for research and engineering at the Department of Defense (DoD), said that U.S. military looking to use 5G networks on battlefields abroad may consider adopting commercial 5G, and select components that could be integrated into military tactical networks overseas, Breaking Defense reported Wednesday.

“As we get closer to the tactical edge, and either in parts of the world where the infrastructure is … not necessarily trustworthy… or actually in a contested tactical environment against a peer adversary, that’s where we think that there’s some challenges,” Evans said Wednesday at an ACT-IAC conference. “That’s where we have to start looking at … what bits and pieces of 5G we can use.”

“There’s mixes and matches of some of the underlying technologies that we think will be useful in the tactical environment,” he added.

The Pentagon made $600 million in awards in early October to support 5G testing and experimentation projects with 15 companies at five U.S. military installations and Evans provided updates on those projects.

DoD announced in June seven more military bases to host 5G experimentation and has issued calls for white papers for three of those sites. Evans said stakeholders have until Nov. 15 to submit white papers, but the department anticipates extending the deadline into December after companies asked for an extension.

The National Institute of Standards and Technology is looking for pubic input on a draft update to the agency’s personnel verification guidelines for federal employees and contractors.

NIST said in a Federal Register document that it is requesting feedback on its draft Federal Information Processing Standard 201-3 for the personal identity verification of contractors in physical and logical access applications.

The guidance covers expanded specifications of Personal Identity Verification (PIV) credentials, procedures for remote identity proofing and other modifications to authentication mechanisms in line with agency requirements.

According to NIST, FIPS 201-3 will only cover the verification of individual identities in compliance with federal agencies and departments’ respective applications.

The standard will not cover temporary credentials and access control decisions, the document states.

NIST plans to hold a public workshop on the draft standard and will accept feedback within 90 days of its publication.

Army Research Laboratory has used game theory to understand how cybersecurity operators can deceive cyber actors and in turn, prevent attacks.

“Game theory allows us to analyze the behavior of intelligent adversaries, predict adversaries course of action and find the best response to protect our network,” said Dr. Charles Kamhoua, senior electronics engineer in the lab’s Network Security Branch. 

The U.S. Army said Tuesday it used security games to graphically depict or model the different approaches taken by cyber actors, then analyze multiple strategies to deceive the attacker.

“An attack graph also helps find all possible combination of vulnerabilities an attacker can use from any entry point to any target," said  Kamhoua added.

ARL researchers virtually presented their work on this topic at the 2020 Conference on Decision and Game Theory for Security that took place late October.

Worcester Polytechnic Institute helped ARL assess the use of decoys in scenarios when attackers have limited information on the targeted network.

The Defense Advanced Research Projects Agency provided partial funding for the effort.