Many of us trust Google Authenticator to add a layer of security to our accounts. But, Google Authenticator has a serious security vulnerability which makes it unacceptable for CMMC compliance and dubious for general use. By default, Google Authenticator syncs your one-time codes to your Google account in the Cloud. Read more…
Bluetooth should be avoided on systems doing any kind of work for the Federal government – DoD or civilian. When tightening security for system access, it’s important to consider all vectors of attack—especially Bluetooth-enabled peripherals like keyboards, mice, earbuds, and other devices. Here’s why: CMMC Control AC.L1-3.1.1 (Access Control): This Read more…
For CMMC compliance, will DoD provide standardized templates for a System Security Plan (SSP) and Plan of Action and Milestones (POA&M)? No. The DoD does not plan to create specific templates for compliance documentation, recognizing that each organization is unique. A “one-size-fits-all” template would not generally be helpful. DFARS 252.204-7012 Read more…
This week’s release of the first three post-quantum encryption standards by NIST—FIPS 203, 204, and 205—marks a significant step in securing data against the threat of quantum computing. These standards aim to protect encryption and digital signatures from quantum attacks, ensuring that sensitive data remains secure as technology evolves. Here Read more…