Joni Pepin

JWCC Q&A is out on sam.gov from Defense Information Systems Agency... I couldn't help but chuckle at the question from industry... they're 100% correct. Why does JWCC UCM Core retain a Third-Party Marketplace if a separate JWCC UCM Premier (Tier II and Tier III) vehicle is planned? Government Response: The UCM Core Third-Party Marketplace is a Contractor-hosted capability for approved third-party offerings integrated with or delivered through the UCM Core CSP environment. Separate UCM Premier (Tier II and Tier III) pathways are intended to address other procurement models and do not eliminate the need for Cloud Service Provider (CSP)-hosted marketplace functionality within UCM Core. The Government intends to define the boundaries between these pathways in proposed solicitation documents, while providing the Government with maximum flexibility. True e-commerce marketplaces have perplexed acqusition professionals. It's that disruptive. Pellucid Network plans to help operationalize them for regulated industries. Reach out if you want to learn more. https://lnkd.in/eXkJEc5M

18

5 Comments

Government contractor exposed path to immigration records https://ift.tt/eMJvsfr Welcome back to PWNED, the column where we look at all the ways your security can become self-owned. Today’s scary story involves government contractors who just had to make their lives easier at the expense of locking down sensitive information. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our tale of bureaucratic hell comes courtesy of security researcher Joe Brinkley, who previously worked for a government contractor as an information system security officer responsible for firewall rule changes, plus network intrusion detection and prevention. To improve the contractor's ability to deploy program changes, some of the org's developers wanted to change the firewall rules so it would be easier to move data from a low-security datacenter where they tested new code to the classified datacenter that housed the production server and data. They wanted to be able to VPN into a low-security commercial datacenter, where other non-governmental tenants, such as Microsoft and Oracle, had servers accessible through the same VPN connection. The datacenter itself provided the VPN, not the government. Back then, in the early 2010s, developers would use a provisioning server to help deploy code from dev to production. But there was always a hard firewall between the classified datacenter and the non-classified datacenter. The developers wanted this provisioning server to be able to access all of the production servers that sat in the classified datacenter so they could more easily push the code around. When the developers suggested they make this change for ease of deploying code, Brinkley told the Change Review Board that it was a very bad idea. “It creates a very glaring issue that we are going from a low-level secured datacenter all the way up to a high-level, top secret secured datacenter for production, and you guys are opening up a firewall rule that would allow anybody from that low level datacenter to have access into, at a minimum, into the high level datacenter,” Brinkley said. However, during a week when Brinkley was on vacation, the developers who wanted this firewall change talked directly to the Change Acceptance Board and got the rule changed. When he got back, Brinkley got a member of his company and a government representative to sit down for a demonstration. Tethering his laptop to his cell phone, he logged into the dev server over the VPN — then turned the box on and off. Then he showed how, with the very same VPN connection, he could get into the prod server and control it. This was a server that had 50 million records about immigration: who was coming to the country, who those people stayed with, and so on. According to Brinkley, thousands of people had access to the commercial datacenter’s VPN, but only dozens were supposed to have access to the classified...

2

The C3PAO assessment process is broken. We're fixing it. Here's the current reality for defense contractors: → Spend weeks finding a qualified C3PAO → Email massive ATO packages back and forth → Pay $15K-$40K without knowing what you're getting → Wait months for assessment scheduling We just launched the first C3PAO Marketplace inside Bedrock CMMC. How it works: 1. Contractors: Publish your CMMC ATO package directly to vetted assessors 2. C3PAOs: Browse contractor packages, review readiness, submit proposals 3. Both parties: Negotiate terms, schedule assessments, manage everything in-platform No more file shuffling. No more email chains. No more mystery pricing. Assessors get instant access to complete ATO packages - SSPs, POA&Ms, evidence, asset lists. Contractors get transparent pricing and can compare multiple C3PAO proposals. This is how CMMC assessments should have worked from day one. Beta launching Feb 2026. If you're a C3PAO or defense contractor, DM me for early access.

4

Jacob Horne the Office of the DoW Chief Information Officer should bring you in to talk. I get the intent of relook at the CMMC. We the taxpayers have invested a tremendous amount of money from looking at putting sensors on networks to which was a hard NO from industry. To putting everybody into a government cloud environment, to which was a hard note for every lawyer in industry. I know from where I’m sitting in security and looking at the next 18 months it’s critical that the defense industrial base is locked down. We’ve got to be doing the basics every single day any miss step is going to be catastrophic.

184

68 Comments

In GovCon, optimism is expensive. One of the biggest mistakes I see: Treating SAM.gov like a buffet. Every opportunity looks tempting. Everything feels “within reach.” So teams pile their plates high… and wonder why they feel sick at award time. Chasing everything isn’t strategy. It’s anxiety with a proposal template. If you can’t clearly answer “why us?” without using generic phrases, you’re already behind. Not: We have experience. We understand the mission. We have qualified staff. That’s the baseline. The real question is: Why are we the low-risk decision? Under the FAR, evaluations are structured and comparative. Your proposal isn’t judged in isolation. It’s judged against someone who probably looks a lot like you on paper, and majority of small businesses fail to accept and understand that. If your differentiator needs a long explanation, evaluators won’t go searching for it. They’re scoring, not dating. Strong contractors do three things well: • They qualify hard • They walk away often • They bid where they can win, not just where they can compete Discipline doesn’t feel exciting. It feels selective. But selective firms build past performance that compounds. Before you greenlight the next bid, ask: Are we pursuing this because it fits our strategy or because it exists?

9

We’re graduating brilliant Engineers who aren't taught that "Security" is a core physical requirement. Research shows fixing a flaw post-launch is 100x more expensive than designing it in. ​We don’t need more "Patch Managers." We need Systems Degrees with a Security DNA. Stop patching the holes. Engineer the ship. ​#SystemsEngineering #CyberSecurity #SecureByDesign #STEMEducation

1