//
CISA Calls on Network Defenders to Take Action Against Adobe ColdFusion Vulnerability Risks
Published on
CISA Calls on Network Defenders to Take Action Against Adobe ColdFusion Vulnerability Risks

The Cybersecurity and Infrastructure Security Agency has issued an advisory concerning the exploitation of a vulnerability within select versions of the Adobe ColdFusion web application development platform that resulted in the compromise of two public-facing servers operated by a federal civilian executive branch agency.

CISA said in its Dec. 5 cybersecurity advisory that each server was illegally accessed in two separate incidents in June, though it is not clear if the same malicious actors are behind both breaches.

CISA documented the tactics, techniques and procedures that the malicious actors employed — including the implanting of software tools and the subsequent attempts to harvest user account credentials — and called on network defenders to monitor for similar activity on their systems.

The agency also recommended several other measures to defend against such attacks, including the continuous scanning of internet-facing systems, the implementation of phishing-resistant multifactor authentication, the enforcement of stringent application control and the patching of software affected by the vulnerability.

/
Brig. Gen. Ed Barker Offers Update on Army’s New Starts for FY25, TITAN Program
Published on
Brig. Gen. Ed Barker Offers Update on Army’s New Starts for FY25, TITAN Program

Brig. Gen. Ed Barker, program executive officer for intelligence, electronic warfare and sensors at the U.S. Army, said the Theater Signals Intelligence Program or TSIG, the High Altitude Platform or HAP for deep sensing and the Spectrum Situational Awareness System are among the service branch’s new starts for fiscal year 2025, Breaking Defense reported Wednesday.

TSIG will “provide the tactical commanders at echelons above corps with a forward deployable and remotely or even locally controlled signals intelligence systems and supporting potential … contingency operations,” Barker told reporters on Tuesday.

He said the Army expects to release more requests for information for the HAP program over the next four to six months.

Barker also offered updates on the Modular Electronics Spectrum System program, the Electronic Warfare Planning and Management Tool and the Tactical Intelligence Targeting Access Node, or TITAN.

TITAN is a tactical ground station that uses artificial intelligence to process data across space and ground-based sensors and the military official noted that the Army plans to select by the second quarter of FY 2024 one vendor to further mature its prototype and build basic and advanced variants for the TITAN program.

/
Peraton-PingWind Joint Venture Secures $155M VA Contract to Assist Suicide Prevention Initiatives; Tarik Reyes Quoted
Published on
Peraton-PingWind Joint Venture Secures $155M VA Contract to Assist Suicide Prevention Initiatives; Tarik Reyes Quoted

A Peraton-PingWind joint venture has booked a $155 million U.S. Department of Veterans Affairs contract to aid military and veteran-focused suicide prevention initiatives.

Under the award, Clear Vantage Point Solutions will provide support for the VA’s National Strategy and for Preventing Suicide and the White House’s Plan for Reducing Military and Veteran Suicide, Peraton announced from Reston, Virginia on Thursday.

“As the natural next step for transitioning military and reservists, we cannot underscore how close to home this mission is to our team,” said Tarik Reyes, president of Peraton’s defense mission and health solutions sector.

Building on the company’s previous work with the Department of Defense Personnel and Security Research Center, also referred to as PERSEREC, the mentor-protégé joint venture will help VA with outreach targeting historically underserved populations, such as rural and marginalized veteran communities and LGBTQ+ veterans.

While working with PERSEREC, Peraton and other collaborators focused on research and development programs intended to enhance personnel suitability, security and reliability policy and practice.

During the contract’s more than two-year period of performance, Peraton’s team will develop and conduct a Feasibility Analysis and Implementation Plan that will outline findings and suggestions for VA’s execution of its suicide prevention strategies. The company’s established relationship with America’s Warrior Partnership will inform these efforts.

“We humbly accept the honor to leverage previous experiences and the full breadth of our capabilities to support VA on this critical initiative,” Reyes said.

/
EIDS PMO Migrates Decades of Healthcare Data to MHS Information Platform
Published on
EIDS PMO Migrates Decades of Healthcare Data to MHS Information Platform

The Enterprise Intelligence and Data Solutions Program Management Office within the Program Executive Office Defense Healthcare Management Systems has completed migrating two legacy data warehouses and over 1 petabyte of data into a data analytics system called MHS Information Platform, or MIP, as part of the Defense Health Agency’s Operation Helios, DVIDS reported Tuesday.

Operation Helios is a strategic modernization initiative that seeks to establish a secure location and related data catalog to ensure that medical providers have access to historical health data to support patient outcomes and insights.

MHS Data Repository or MDR and MHS Mart, or M2, are the two data warehouses that transitioned to MIP.

MDR contains health care data provided to Military Health System beneficiaries, while M2 is a relational database containing DHA healthcare data and is used in managing military clinics and hospitals.

“The Operation Helios team’s achievement lays the cornerstone of DHA’s vision of data standardization and normalization and harnessing data to drive better clinical outcomes for beneficiaries,” said Chris Nichols, EIDS program manager.

With Operation Helios, EIDS PMO combined MDR and M2 data from Defense Information Systems Agency on-premise servers to the MIP to facilitate the integration, validation and distribution of DHA health care data.

CISA Sees Progress in Cybersecurity Performance Goal Implementation
Published on
CISA Sees Progress in Cybersecurity Performance Goal Implementation

The Cybersecurity and Infrastructure Security Agency has seen positive trends in its cybersecurity performance goals, or CPG, relating to mitigating known vulnerabilities and removing exploitable services on the internet.

CISA officials said in a blog post published Tuesday that organizations enrolled in the agency’s vulnerability scanning service have decreased the average number of known exploited vulnerabilities, a.k.a. KEVs, on their networks by almost 20 percent since the CPGs were released in October 2022.

The agency has also seen progress toward the first CPG’s recommendation to patch or mitigate KEVs on internet-accessible assets.

In addition, CISA has revealed that public-facing assets with exploitable services on the internet exhibited modest declines, indicating progress in removing exploitable internet services since the CPGs were published.

/
André Mendes Retires as Commerce CIO
Published on
André Mendes Retires as Commerce CIO

André Mendes is stepping down as chief information officer for the Department of Commerce on Dec. 31 after 14 years of service in the federal government.

In a LinkedIn post published Tuesday, Mendes shared that he will take on a CIO role for Tarrant County, Texas, starting Jan. 2.

Mendes was appointed CIO of Commerce in August 2020 and has since taken over responsibility and oversight of technology systems used at the department and its associated bureaus.

Before that, he held the top IT role at the International Trade Administration and helped drive the bureau’s digital transformation and cloud adoption efforts.

He also held various leadership roles at the U.S. Agency for Global Media, including CEO, chief operating officer, chief technology officer and chief financial officer.

/
NASA’s John Dankanich Discusses Impact of Data Access Limitations on Tech Development Efforts
Published on
NASA’s John Dankanich Discusses Impact of Data Access Limitations on Tech Development Efforts

John Dankanich, in-space transportation system capability lead at NASA, spoke about contracting approaches used with various vendors to support development work on cryogenic fluid management systems and how such mechanisms hinder the space agency’s ability to access data needed to understand how such technologies work with other platforms, SpaceNews reported Tuesday.

Cryogenic fluid management systems are designed to support in-space propellant storage and transfer and are a key component of lunar landers and other space vehicles.

“We want to be able to test different configurations. The issue that we have is the different procurement mechanisms that we’ve been using with our industry partnerships,” Dankanich said at an event Monday.

“We have a real challenge getting telemetry and the data that we want for model validation without having data restrictions on the overall system design and performance,” he added.

According to Dankanich, companies are developing cryogenic fluid management systems either through NASA’s Human Landing System program or Tipping Point awards.

He noted that Tipping Point awards that are being carried out as Space Act Agreements restrict how the agency can access data and manage work on cryogenic fluid management tech development projects.

/
GAO Report Finds Gaps in Federal Agencies’ Event Logging Practices for Cybersecurity Incident Response
Published on
GAO Report Finds Gaps in Federal Agencies’ Event Logging Practices for Cybersecurity Incident Response

The Government Accountability Office found that 20 federal agencies failed to meet the standards for cybersecurity incident response preparedness due to staff shortage, IT challenges and limitations in information sharing.

A GAO report released Monday showed that while the government departments have made progress in cyber threat response, there are still gaps in event logging, investigation and remediation.

The government watchdog investigated the 23 agencies covered by the Chief Financial Officers Act of 1990, which was established to improve financial management and disclosure across the departments.

GAO learned that the all of the agencies completed required activities under the Cybersecurity and Infrastructure Security Agency playbook. However, 20 of the offices failed to reach maturity level 3 of the Office of Management and Budget’s M-21-31 memorandum on cyber incident investigative and remediation capability assessment.

The report’s main recommendation to the concerned departments was to fully implement requirements for event logging. It also suggested 19 other courses of action, including additional details on continuity of operations planning in the CISA Federal Government Cybersecurity Incident and Vulnerability Response Playbooks.

DOD Amends Freedom of Information Act Program With Final Rule
Published on
DOD Amends Freedom of Information Act Program With Final Rule

The Department of Defense has released a final rule amending the Freedom of Information Act, or FOIA, regulation to add additional FOIA requester service centers and update organizational names.

With the final rule, DOD is implementing the standards outlined in the Department of Justice’s Template for Agency FOIA Regulations stating that the decision to take part in FOIA alternative dispute resolution services is voluntary on the part of DOD and the requestor, according to a Federal Register notice published Tuesday.

Under the FOIA amendment, the Pentagon is changing the Directorate for Oversight and Compliance to the Office of the Assistant to the Secretary of Defense for Privacy, Civil Liberties and Transparency and the Defense Security Service to the Defense Counterintelligence and Security Agency.

The department is adding U.S. Cyber Command, U.S. Southern Command, U.S. Space Command and U.S. Space Force as authorized FOIA requester service centers.

“The benefit of USCYBERCOM and USSPACECOM establishing their own FOIA Requester Service Center is that FOIA action officers would have a direct and deeper knowledge of USCYBERCOM and USSPACECOM records, allowing for requests to be more readily completed within statutory timelines,” the notice states.

The rule will take effect on Jan. 4.

/
DOD Aims to Bolster Metals Supply Chain Through Award to 6K Additive; Laura Taylor-Kale Quoted
Published on
DOD Aims to Bolster Metals Supply Chain Through Award to 6K Additive; Laura Taylor-Kale Quoted

The U.S. Department of Defense has selected 6K Additive, LLC for a $23.4 million award to deepen its waste and scrap metal upcycling capabilities.

With the funding, 6K Additive will upgrade facilities, acquire and install equipment and conduct engineering activities to support the conversion of these materials into high grade metals for both defense and commercial supply chains, the DOD announced on Tuesday.

“U.S. dependency on foreign sources for specialty metals presents a significant risk to national security. 6K’s products will feed supply chains that form the basis of our military’s core warfighting capabilities,” said Laura Taylor-Kale, assistant secretary of defense for industrial base policy.

Contracting responsibilities are expected to increase the production capacity for metals such as titanium, niobium, nickel and tungsten, which are used in alloys for aircraft structural components, turbine engine blades, rocket engines and radar systems, among other defense technologies.

6K Additive uses domestic sources of metal feedstock, including end-of-life components, machine shop waste and scrap from manufacturing processes like casting and forging, for its upcycling activities.

The award was issued through the Defense Production Act Investment Program, which has funded $735 million in awards this year.

1 … 410 411 412 413 414 … 2,621