Stephen Gubenia

Hello GSA Contract Holder, This is to invite you to a free informational webinar designed specifically for GSA Schedule holders interested in the upcoming GSA SCRIPTS BPA opportunity. This is a $919M multiple-award BPA opportunity with 8 awardees, with small businesses set aside and full and open tracks. SINs are 518210C, 54151ECOM, 54151S, 541614SVC, 541990RISK, and 541611. Webinar Schedule Wednesday, August 21st, 2:00 PM EST Thursday, August 22nd, 2:00 PM EST Register here: https://lnkd.in/gxGXrxCF Why You Should Attend This is an exclusive 10-year opportunity set aside for GSA Schedule holders. The final RFP is anticipated to be released in October 2024, so now is the time to prepare! What You Will Learn in the Webinar Background to the GSA SCRIPTS Opportunity: Understanding the pain points and the necessity behind SCRIPTS BPA. The SCRIPTS BPA Opportunity Explained: A high-level overview of the GSA SCRIPTS opportunity. The Proposal Requirements: A detailed discussion on how to prepare a winning proposal. The Source Selection Process: Insights into how the government's source selection process works. Partnering: How partnering can enhance your chances of success. Strategy Recommendations: Tips and strategies to increase your win probability. Q&A Session: Get your questions answered by industry experts. Register now to secure your spot in the webinar and take the first step towards winning this lucrative contract. We look forward to seeing you there!

1

My book 📚 "Incident Response with Threat Intelligence" is also included in this promotion 🤓

65

7 Comments

This is to invite you to a free informational webinar designed specifically for GSA Schedule holders interested in the upcoming GSA SCRIPTS BPA opportunity. This is a $919M multiple-award IT opportunity with 8 awardees, with small business set aside and full and open tracks. The RFQ was issued on August 19th and you have approximately a month to prepare your proposal. Webinar Details Wednesday, August 21st, 2:00 PM EST Thursday, August 22nd, 2:00 PM EST Register here: https://lnkd.in/gxGXrxCF Why You Should Attend This is an exclusive 10-year opportunity set aside for GSA Schedule holders. Your proposals are due by September 16th, so now is the time to prepare! What You Will Learn in the Webinar Background to the GSA SCRIPTS Opportunity: Understanding the pain points and the necessity behind SCRIPTS BPA. The SCRIPTS BPA Opportunity Explained: A high-level overview of the GSA SCRIPTS opportunity. The Proposal Requirements: A detailed discussion on how to prepare a winning proposal. The Source Selection Process: Insights into how the government's source selection process works. Partnering: How partnering can enhance your chances of success. Strategy Recommendations: Tips and strategies to increase your win probability. Q&A Session: Get your questions answered by industry experts. Register now to secure your spot in the webinar and take the first step towards winning this lucrative contract. We look forward to seeing you there!

1

Aeterneus Intel InfoSec Update: Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation (FBI) just dropped their latest Secure by Design report on XSS vulnerabilities. The guide is trying to get software companies to use more secure design and secure coding principles when creating new systems and software. Keep in the loop on threats and research by following Aeterneus Intel! #threatintelligence #CTITRIAGE #cybersecurity #software

1

Someone asked me this week which PCI DSS requirement is the most important. 🤔 Of course, my reply was, "All of them!" But if I had to pick one. I'd say 12.5.1 takes the crown. 12.5.1: An inventory of system components that are in scope for PCI DSS, including a description of function/use, is maintained and kept current. Why does this basic requirement stand out to me? Because you can't protect what you don't know you have! This is why I believe understanding the scope is the crucial first step of any assessment. 1) Visibility is Key: Knowing exactly what you need to protect is the foundation of any strong security posture. This inventory provides a clear picture of your in-scope systems, eliminating any guesswork. 2) Reduce Your Attack Surface: By accurately identifying and documenting system components, you can pinpoint vulnerabilities and prioritize remediation efforts. 3) Streamline Incident Response: In the event of a breach, a comprehensive inventory enables rapid response and minimizes damage. Which requirement would you pick❓ #PCIDSS #v4.1 #datasecurity #compliance #cybersecurity #informationsecurity #RiskManagement #DataProtection

34

4 Comments

Some excellent, brutally honest insights re: the current #cybersecurity job market as we approach 2025. TL;DR: The takes on Red Team vs. Blue Team opportunities and the realities of both career paths are spot on… I’ve posted about the #offsec conundrum (in long form) before, but this author distills it down to very direct key points. This piece is great for #pentesters banging their heads against the job search wall, as well as #entrylevel folks looking for a healthy dose of realistic inspiration. It’s also an important reminder of the ongoing critical need for #defender talent, as #threat actors grow bolder, attacks become more sophisticated (#AI), and geopolitical tensions increase. Happy Monday, Rogue Squad! 💪 #onward #gorogue #infosec #careers #hiring #appsec #websec #k8sec #reversers #researchers #FTE

7

🙏Thank You for participating in Poll shared a week before. I want to extend a huge thank you to everyone who took the time to participate in the poll I shared recently. Your input and insights are incredibly valuable to me, and I truly appreciate your engagement. Please watch the complete video : https://lnkd.in/gG29XVUt To know more visit: https://www.cybernous.com/ #cissp #cissptraining Cybernous Infosec Consulting LLP Pratima Sharma

8

CISSP Twister of The Day (ToTD) Q. No 150 🎆🎇 Hey! A big congratulations to all of you as we have reached at 150th question in the form of ToTD Today. 🌟 Let's ignite some mental fireworks, folks! 💡🚀 💪 Remember, every question is an opportunity to learn and grow. So whether you nail it on the first try or use it as a chance to expand your knowledge, you're on the right track! 🌟 🧠 Get ready to flex those CISSP muscles because it's quiz time! 📝💼 🎯 Sharpen your focus and dive into the world of cybersecurity with this challenging question based on CISSP concepts. 💻🔒 🚀 Let's crush this quiz together and show the world the power of continuous learning and expertise! 💥💼 👉 Drop your answers in the comments below and let's spark some insightful discussions! 🗣️💬 TO CHECK ANSWER 👉👉: https://lnkd.in/gi3CqPug #CISSP #Cybersecurity #QuizTime #ContinuousLearning #Expertise #ChallengeAccepted 🌟 Cybernous Infosec Consulting LLP

10

3 Comments

Cybersecurity Snapshot: Study Raises Open Source Security Red Flags, as Cyber Agencies Offer Prevention Tips Against Telecom Spying Attacks http://ow.ly/oY7H105QVQA

2

The IT Privacy and Security Weekly Update for the Week Ending December 31st., Breaks out of 2024 and into 2025! EP 223 For this update, a completely diverse collection of stories starting with Apple dodging the search engine game by insisting that search ads are not Apple's "core" expertise. Then another serving of fruit and Raspberry Pi’s billion-dollar boom proving that tiny computers with huge valuations says you don’t need size to make a big impact. Chinese hackers demonstrate that it makes "cents" to have the US Treasury's data on their holiday gift list. And then for your next security conference, forget peanuts on your flight, now you have to worry about missiles landing on your snack tray. Seniors swim in student loan debt while Grandma knits scarves—and tries to figure out how to pay off her 50 year old university degree. VW's massive EV data leak reveals that your car is smarter than ever and so are the hackers. Then, it's not only the North Koreans who can play at this game, Maine prisoners go remote, landing virtual gigs as legit IT staffers. This is a wild update, so let's use it to break out of 2024 and into 2025! Update: https://lnkd.in/ejUUx2Md Podcast: https://lnkd.in/eQ54xi2c

2

Ask the CCP: SCOPE AND BOUNDARIES-CLOUD & MSSP So, I am counting the days until (around) October 28th: • 56 is the approximate number of work days . . .   . . . that sometime in late October: CMMC version 2 will (might) become effective. THIS JUST IN - the CyberAB projected that the Effective-ness of CMMC version 2 might not occur until maybe March of 2025. I posted a 1-off in yesterday’s installment (T.A.R.D.I.S).  1. TO LEAD with Yesterday’s topic which is boundaries I will preface today’s discussion which is noted above with commentary about how to represent your boundaries. Historically there’s always been a balance in security diagrams that the IT staff seems to not always grasp. Meaning that I have seen some truly awful data flow diagrams and boundary diagrams as an assessor for the last couple of decades. And already out there we go So my prescription for all the OSC , is to get your CMMC certification boundary and assessment boundary well defined early. The certification boundary coincides with your list of CMMC assets against other types of assets. Likewise your CMMC assessment boundary shows what is going to be assessed there are demonstrative diagrams available as examples. As I am quite adept at creating these, DM me if you need assistance with creating Data Flow Diagrams as well as Boundary Diagrams and Assessment Diagrams. These are critical to get correct for your CMMC evaluation.  2. This installment goes deeper to addressing cloud tenants and Managed IT/Security Services (MSSP). It is stated in CMMC V2 rule that Cloud Service Providers (CSP) are not part of the CMMC boundary – only the Organization Seeking Certification (OSC) tenant is to be a CMMC Asset. However, MSSPs hosting IT and Security Assets for the OSC are within the CMMC Boundary and Scope. This based on no separation between the organizations, meaning that CMMC assumes the MSSP has insight to the OSC’s information.  Therefore MSSPs must be concurrently certified to the same as the OSC they are supporting. However, DoD is not yet permitting MSSPs to enter the CMMC Certification processes.  Advice to MSSPs is therefore, be prepared for complete CMMC compliance immediately.  #CMMCv2 #boundary #assessment #dfd I Prepare and Evaluate Organizational Readiness for CMMCv2. So if you have any questions. . . .  Since I am both CCP and Certified Instructor, I am a CUI expert Or at least I know where to find the specifications and details 🤔 Tap Me/DM here on LinkedIn or email

1

Ask the CCP: ASSESSMENT GUIDES So, I ‘was’ counting the days until (about) October 28th: •         56 is the approximate number of work days. . .  . . . that sometime in late October: CMMC version 2 will (might) become effective. BUT - the CyberAB projected that the combination of various deadlines to White House to Congress as I’ve also mentioned previously that the effective-ness of CMMC version 2 might not occur until maybe March of 2025. Again I take it as authoritative from the CyberAB but in the end, it’s another estimation…. CMMC Documentation-SEE: https://lnkd.in/eMJtfdd2 Links to Scoping Guidance Link to CMMC Level 1 Scoping Guidance Link to CMMC Level 2 Scoping Guidance NOTE: The documents present on this site as of this date 19 August 2024 are NOT up to date!! ·        CMMC Assessment Level 1 Scoping has a publication date of December 2021. ·        The CMMC Assessment Level 2 Scoping Is also December 2021 ·        CMMC Self Assessment Guide Level 1 is also December 2021 ·        CMMC assessment Guide Level 2 is also December 2021 These documents might possibly still be minimally accurate enough to utilize in mid 2024. But CMMC version 2 introduces many changes and even some new terminology so that I would suspect that these documents should be replaced (or actually should have already been replaced since December of 2023). If you need an authoritative up to date expert source for scoping and assessments then give me a tap and I can most certainly help you in all matters CMMC. Or you could wait until DOD might possibly update these above listed documents- And hope that they show up in time. #CMMCv2 #CMMCDOCUMENTATION #CMMCSCOPING #CMMCGUIDE I Prepare and Evaluate Organizational Readiness for CMMCv2. So if you have any questions. . . . Since I am both CCP and Certified Instructor, I am an Expert Or at least I know where to find the specifications and details :0 Tap Me/DM here on LinkedIn or email

1

CompTIA-Jamaica: "... I have taken on added responsibility of performing vulnerability scanning and to some extent, manual testing to confirm vulnerabilities. With this added responsibility i thought it important for me to gain additional knowledge on the tools and techniques to perform these tasks and the CompTIA PenTest+ certification was the best place to start." Congratulations to Andre Grant for earning his CompTIA PenTest+ certification!!!! He used this to extend the lives of his CompTIA Security+ and CompTIA Cybersecurity Analyst (CySA+) another three years. "My recommendation to anyone who wants to attempt this exam is to just practice, the theory on how to perform the tasks and what to do with the information gathered is good to have but setting up virtual labs and actually performing the activities give a much greater understanding and appreciation of the concepts." Learn more about CompTIA: https://lnkd.in/etQpaCjd #comptia JAMAICA CUSTOMS AGENCY Wayde Marr Otis Niel Osbourne

111

6 Comments

Resource Control Policies have arrived. These are the resource-centric guardrail counterparts to the principal centric Service Control Policies. A fine addition to the data perimeter collection. I'm looking forward to testing this out on S3 bucket policies soon. https://lnkd.in/gByp_6fs

17

2 Comments