Note: This is unrelated to Microsoft’s announcement of security patches for other similar vulnerabilities on April 13, 2021.

THERE ARE NO MORE RULES

Today we are going to talk about what happens when you do not address security problems in your private Information Systems (IS): the systems that you as an individual, or as an organization, manage and run to maintain your business.

Historically, the government has needed your permission to access your systems. Whether that was to spy on you or to ‘help’ you. That has now changed.

WHAT HAPPENED?

The Federal Bureau of Investigation (FBI) executed a court-authorized program to remove malicious code from vulnerable Microsoft Exchange Server (MES) servers in the United States in response to the reported widespread exploitation of critical vulnerabilities by malicious cyber actors. The MES servers that were ‘fixed’ were on-premises versions of MES, a software used to provide e-mail service.

The FBI program was designed to fix the systems but did not include other mitigating actions, such as patching MES vulnerabilities or identifying and removing any malware or hacking tools that may have been hidden on these networks. The program’s goal was intended to prevent future attacks on US organizations.

WHO TRIED TO ATTACK US?

The first Advanced Persistent Threat (APT) group to utilize these vulnerabilities was referred to as HAFNIUM, and many times the attacks themselves are mislabeled as ‘HAFNIUM attacks’.

HAFNIUM has been identified as targeting organizations in the United States across industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and Non-Governmental Organizations (NGOs).

HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers (such as email or FTP servers).

HOW DID THEY DO THIS?

The technical details of these attacks are beyond the scope of this discussion. For more information, visit the Microsoft page, HAFNIUM targeting Exchange Servers with 0-day exploits – Microsoft Security

WHY DID THIS HAPPEN?

Reports of groups exploiting zero-day vulnerabilities in MES software were first discovered in January of 2021. These vulnerabilities were actively being used to access and read emails from the server of any email accounts. There also was evidence that during exploitation, more code was added to the system to allow further access at a later date. Because each code had a unique name and was located in a unique file directory, there was not a ‘find-this-file-and-delete-it’ type of solution.

N.B. Microsoft indicated that this vulnerability only affected on-premises systems and not Exchange Online.

Compromising these systems allowed the perpetrators the ability to read any information in the mailboxes of users, steal user logins and passwords, add new accounts, steal network authentication database, and move to other systems in that network. As an additional problem, they installed ‘back doors’ for future access.

This sounds alarming, but of course, security researchers identified this in January. So, what’s the problem? The problem is that Microsoft did not address the multiple vulnerabilities and issue a patch to fix this publicly until March. By that time, thousands of servers had been compromised, millions of emails had been read, and thousands of ‘back doors’ had been established that would require a lot of time and research to identify and address.

It is expected that some of the information that was gathered was private, confidential, and federally defined Controlled Unclassified Information (CUI). Although government contractors and sub-contractors all attest to their information systems being secure, some clearly were not and many run their own on-premise MES.

Frankly, this is a worst-case scenario. A criminal could get access to not only any emails, but potentially could access almost anything by requesting a password reset and confirming the reset via email. On a scale of 1-0, this was a hard 10.

BUT I HAVE CUI!

If you’re using Microsoft Exchange for your mail, make sure that you or your provider are either using the latest patches on your version of Exchange and/or bring in some professional help to look for compromises.

Of course, you could always rely on communicating CUI through a trusted partner. One that can not only ensure your CUI is secure, but a company that also sends email through its own servers, and those emails link to the document, requiring additional security. A closed environment for CUI, such as that provided by RegDOX, would have mitigated the problems in maintaining the confidentiality of CUI that was caused by this breach.

WHAT HAS BEEN THE RESPONSE BEFORE THIS?

To their credit, on March 15, 2021, Microsoft did release a ‘one-click mitigation tool’ which fixes the problem from occurring if the system has not been infected yet. You can access this tool here (https://aka.ms/eomt).

This Microsoft tool was designed as “…an interim mitigation for customers who are unfamiliar with the patch/update process or who have not yet applied the on-premises Exchange security update”. The tool is not intended as a replacement for regular security updates but is “the fastest and easiest way to mitigate the highest risks to internet-connected, on-premises Exchange Servers prior to patching”.

Throughout March, Microsoft and other vendors issued detection tools, patches, and other information to assist in identifying and mitigating the issue. The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) released an Advisory, “Compromise of Microsoft Exchange Server” on 10 March 2021. Additionally, Microsoft recommended downloading and using the Microsoft Safety Scanner (Microsoft Safety Scanner Download – Windows security | Microsoft Docs) and keeping it running.

Despite these efforts, by the end of March, there was still an inordinate number of unpatched systems with malicious code and ongoing vulnerabilities. There were systems that had been patched but still may have had the back doors still accessible. CUI was likely still being improperly accessed. Thus, the FBI stepped in.

SO, WE’RE ALL GOOD NOW?

Hardly. If the removal operation was conducted on your system, you will receive additional details from an authorized FBI email account. The FBI continues to conduct a thorough and methodical investigation into this issue.

We can estimate it will be less than one week before the phishing emails go out, purporting to come from the FBI, with instructions to login to the ‘FBI Cyber Portal’ and verify your authenticity. Don’t. Let’s say that again. DO NOT.

Where one Advanced Persistent Threat (APT) group is successful, others will quickly follow. Microsoft originally followed HAFNIUM when they started launching targeted attacks against US organizations. Recently other adversary groups have started targeting the same vulnerabilities, and these attacks will continue to increase as attackers learn more about these vulnerabilities.

Not all these attacks were fully conducted earlier. It is expected that in the future we will see more exploitation.

WHAT SHOULD WE DO?

As previously discussed, downloading and installing patches is of critical importance. This can be easily done using Microsoft’s Windows Update, as well as the MES product updates. The links provided in this article will allow you to download the Microsoft Scanner tool and the one-click mitigation tool, allowing you to begin to assess the damage. Also, you might want to

consider taking your CUI and other confidential information out of the Microsoft Exchange world and using a self-contained system to protect it.

**Keep in mind, that as you coordinate a response to the issue, your mail has been compromised. It would not be difficult for an adversary to intercept emails and issue different instructions or sabotage the process entirely. Do NOT use your email to communicate your intentions!

CONCLUSION

Is this a significant threat to the US? Absolutely. Is the government ‘right’ in breaking into networks and accessing Information Systems of anyone they want without permission? Regardless of having ‘court authorized’ permission, we think that there is some debate and history will determine the answer.

Regardless, organizations should always strive to patch systems as soon as possible, scan systems on a regular basis, and invest in security technologies, training, and people.

About RegDOX Solutions Inc.

RegDOX Solution’s first-to-market ITAR and NIST 800-171 (DFARS) compliant online storage and collaboration product has redefined how export-controlled and CUI documents and electronic files can be handled within regulatory requirements. This was recognized by the formal opinion of compliance provided by the US State Department’s Directorate of Defense Trade Control (DDTC). RegDOX’s unique capabilities were confirmed on August 20, 2019 when the US Patent and Trademark Office issued a patent covering RegDOX’s system to store and manage export-controlled documents in the cloud. (Patent No. 10,389,716). The RegDOX® ITAR/EAR solution provides ground-breaking and unsurpassed technology enabling the efficiency and flexibility of a cloud solution to allow multiple users located at numerous locations to collaborate using controlled data while remaining fully in compliance with the strict regulatory and licensing requirements of the ITAR and DFARS.

www.RegDOX.com

There are five types of clouds: Cumulus, Cirrus, Stratus, and Nimbus. Oh, and that computer thing. You know “THE Cloud”. Or, as it is often referred to, the Clowd – a combination of the words Clown and Cloud. See what they did there?

What Exactly Is “The Cloud”?

Essentially, a ‘Cloud’ is a system for providing on-demand, scalable computer systems (servers) and data storage, but does not require ongoing customer administration. What makes them different from a traditional web host, is that you can instantly scale (increase or decrease) your usage or volume as your business increases or slows down, and your cost goes up or down relatively. Most cloud providers also offer other ancillary products and services, but what it amounts to is renting computer space on someone else’s network. They do most of the maintenance and the behind-the-scenes hard work, and you do whatever it is you do. Usually, costs are based on the length of time spent using their systems, or on the amount of data you store with them, or on the traffic that flows through their networks, or some combination of all of those.

Another thing to consider is that on one hand, it is a product – hardware – solution, but it’s really a Services – software – offering. It’s like a hotel: You bring your things to their place, you agree to pay for a set of services, and they keep the rooms clean, the water running, and the lights on.

And, just like hotels, there are some premier brands and some low-cost providers. The great thing is that the cost of computing power, hard disk storage, memory, and other things like virtualization technology has evolved and significantly dropped in price. However, you usually get what you pay for.

There are private clouds – just for you or your company, or maybe also, your suppliers and customers. It is a closed environment and only selected users are allowed in.

There is the Public Cloud – where everyone can go visit, like an e-commerce store. You want as many possible customers as possible, so you want any user to be able to get to your cloud. They don’t get access to the back end, but they can buy widgets from your store.

There are also other types of Clouds, hybrid, community, big data, but if you go and Google ‘cloud types’, that’s not really the point here.

What Is the Point?

Well, really, there are four (4) points:

1. What is this cloud thing and how does it work? (already covered that)
2. If it is a network of computers, why would it go down?
3. Why do I hear so much about the Cloud leaking or revealing information?
4. What should I do to secure my cloud?

Why Does the Cloud Crash?

There will always be some hardware failures in the cloud or any computer system. Hard disks wear out, parts get old and brittle, wires fray, programming errors surface, it’s just the way it is. Most Cloud companies keep copies of your data in different locations for exactly this reason. Site 1 may go down, but not sites 2 or 3. Properly setting up and configuring your cloud is essential to have a successful program.

Other than time and poor configuration, why would a Cloud go down, you might ask? Well, that’s a good question. As we mentioned, there are many other products and services that Cloud companies offer, which is good because there are services you’ll want or need to integrate into your technology stack without a lot of hassle, but it is bad because every new introduction creates the possibility for conflict or failure.

Think about this: Currently, Amazon Web Services offers over twenty-six (26) different products/services categories on the various AWS Clouds. Within those categories, there are over 150 different individual products. What this means to you is that there are over 150 different systems (not to mention hypervisors (running virtual machines), physical hardware, etc.) and all need to play perfectly with each other every second of the day. It can (and is) certainly possible, but if you think that there are never mishaps or problems, you’re mistaken.

Of course, you also get people that don’t know what they’re doing, you get malicious criminals and pranksters trying to mess with systems, and it’s actually very impressive that they haven’t had a worse reputation. We are unaware of any cloud provider that has not suffered at least ONE significant downtime period.

Recently, for example, Microsoft’s Azure platform had an ‘issue’ with their DNS systems on and off again for about a week, culminating in massive outages for many users. This was not the first time for Azure, as about two weeks ago there was a similar problem and outage, but this was attributed more towards key rotation with their Active Directory identity access management solution (IAM), preventing people from logging into their accounts. We could go on and beat on Azure, but that’s not really the point. The point is that many interconnected systems have an exponential probability of failure.

Why Does the Cloud Leak (And Not Rain)?

There are several reasons why it seems like there’s another ‘leak’ in the news every day. But really, the biggest reason is simple: hubris. If you don’t know how the cloud works, or how each service is intended to work, AND you do not know how to secure the cloud…. you WILL do it wrong. It’s impossible to know everything about everything.

The cloud has what has been called a ‘shared responsibility security model’. Essentially the cloud provides what is necessary to maintain the systems IN the cloud, and companies provide whatever is necessary to secure their systems ON the cloud. At times it seems that some responsibilities cross over, but these need to be clearly defined and understood.

There’s a reason that certifications for understanding the basics of Cloud Computing on each platform exist (AWS Cloud Computing Professional Certification, Microsoft Certified Fundamentals programs, Google’s Associate Certification, etc.). Most of the incidents we read about were due to incorrectly or improperly configured security settings. It’s not that the team was not sophisticated, but ongoing issues, such as those encountered by Azure, suggest that they didn’t know exactly what needed to be done on the platform.

Moving data to the cloud exposes it to several vulnerabilities – most, but not all, of which can be mitigated. This is a prime time for social engineers and criminals to gain access and either steal data or get malware in the system before it is completely secured. Developers also tend to create a test environment (which is good practice) but do not delete it when they are done (which is bad) or leave real credentials in the unsecured development environment.

HOW TO SECURE YOUR CLOUDS

The biggest misconception about the cloud is that a virtual machine in the office is the same as the cloud. Because it is, and it’s not. Sure, there are similarities, but there are key differences. We could spend a lot of time addressing this, but we’re just talking about keeping you and your data safe today.

It seems to go back to the developers’ confidence, knowledge, experience, and, yes, arrogance in providing cloud solutions. Admitting that you do not know something does not make you dumb, or less respected. It makes you look like you are smart enough to know what you do not know, and not put the business at risk. That may be the key to why one cloud platform is more resilient than another.

So, with this in mind:

#1 Know what you don’t know. What you don’t know, get help for. Keep consultants in business.

#2 Have a PLAN if/when you move to the cloud and be sure that includes cleaning up any loose ends. Then have someone come and check your work. Wouldn’t you rather spend a few hundred dollars (ok, maybe more) than the alternative?

#3 Ask your provider for help or recommendations for qualified people to assist.

#4 It won’t hurt to have some of your team get certified in the platform of your choice.

#5 Learn what security offerings the provider has for you to utilize – and utilize them! Whether it’s a monitor (SIEM) or an audit tool, use it!

Enjoy the Clowd and all the benefits it brings – scalability, availability, lower costs, fewer capital expenditures, and hopefully a superior performing application.

About RegDOX Solutions Inc.

RegDOX Solution’s first-to-market ITAR and NIST 800-171 (DFARS) compliant online storage and collaboration product has redefined how export-controlled and CUI documents and electronic files can be handled within regulatory requirements. This was recognized by the formal opinion of compliance provided by the US State Department’s Directorate of Defense Trade Control (DDTC). RegDOX’s unique capabilities were confirmed on August 20, 2019 when the US Patent and Trademark Office issued a patent covering RegDOX’s system to store and manage export-controlled documents in the cloud. (Patent No. 10,389,716). The RegDOX® ITAR/EAR solution provides ground-breaking and unsurpassed technology enabling the efficiency and flexibility of a cloud solution to allow multiple users located at numerous locations to collaborate using controlled data while remaining fully in compliance with the strict regulatory and licensing requirements of the ITAR and DFARS.

www.RegDOX.com

Well, it finally happened. Despite all your efforts in security awareness training and the latest in hardware and software technology, somehow something bad happened: You got breached. Do not freak out or feel too bad.

So, what to do?
What CAN you do?
What SHOULD you do, and what should you NOT do?

WHY DO THIS?

DFARS requires defense contractors and subcontractors to report to the DoD within 72 hours of a cyber incident involving “Controlled Unclassified information (or the equivalent)” and to have a system to retain and to maintain detailed records of the incident(s) for analysis.

As part of the DoD-DIB reporting program, the US Government and each contractor are supposed to execute an agreement, referred to as a Framework Agreement (FA). This framework is designed to share “cybersecurity information”, in a timely and secure manner, regularly, and to the greatest extent possible.

There is also a great emphasis on the importance of informing DoD of potential or real incidents involving export-controlled information. Now we have ITAR and EAR regulations as well to be concerned about.

The regulations also state that “cyber incident reporting requirements for other important types of controlled unclassified information (CUI) (e.g., personally identifiable information (PII), budget or financial information) are more specifically addressed through other regulatory mechanisms, and thus are outside the scope of this rule.” So, let’s hope the bad guys didn’t get anything that requires state disclosures.

Luckily, there is specific information about where to report, how to obtain the credentials to report, and also states that third-party service providers (SP) that assist contractors with cybersecurity can also report on behalf of those contractors. We will leave the ethical and legal questions of should they report for another time.

DO NOT DO THIS:

Let us just get this right out of the way first – you can NOT ignore it, hope no one will find out or wish it away. Do not think about it, don’t even consider it. You will get caught. You will get in trouble. You will face fines (yes YOU, as well as the company), and you could go to jail. And everyone says that you’re way too pretty to go to jail. Just like you can’t break up with someone by text message, you have to face the music head-on, and take it like a champ.

If you don’t think I’m right…. how about these penalties:

• Very large (multi-million, 9 figure) penalties.
• Prevention of doing future business with the DoD.
• Forced monitoring (which you pay for).
• Criminal charges = jail time.

WHAT SHOULD YOU DO?

Before you can go and report an incident, you need to be vetted to submit an incident. I agree this is borderline insane and counterproductive, but I don’t make the rules. You will need to obtain a Secure Certificate – like an SSL for a website, the Certificate both identifies and authenticates you to the Defense Industrial Base’s Network (DIB Net) -the website at https://dibnet.dod.mil/portal/intranet/.

Visiting this website shows that there are two options:

• On the left side: Cyber Reports – Report a Cyber Incident.
• On the right side: DoD’s DIB Cybersecurity Program.

The Cyber Reports area on the left is the one we need to use (the CS Program is for anyone – public, private, or governmental to share information about threats, and ways to address these threats).

You can see that right beneath the button that says, “Report a Cyber Incident”, there is some text explaining that “A Medium Assurance Certificate is required to report a Cyber Incident”. So at least there is some information here to help us. Clicking the underlined text will take us to the DoD Cyber Exchange’s External Certification Authorities (ECA) page – https://public.cyber.mil/eca/.

There is a bunch of text that explains that the DoD needs to have a secure certificate to accept a cyber report. However, the key thing here is the Medium Assurance Certificate, which satisfies FIPS 140 Level 1 requirements.

Reading the tiny print will tell you that you/your company can only have ONE application. Got 10,000 employees across the globe? Too bad. You get ONE. The person is sick, or leaves the organization? No clue what you do then. I’m sure it’s never happened….

Of course, you need to be a U.S. citizen and “authorized to act on behalf of the company during the application process”. It isn’t going to hurt if you understand certificates and technology, but…you’ll figure that out.

TECHNICAL IMPLEMENTATION

As stated, the certificate installation is tied to one machine, for one user. Luckily, the process is the same as importing any other Certificate.

Since there are several types of servers, operating systems, and other variables, the best resource I could find was here: https://www.digicert.com/kb/ssl-certificate-installation.htm

If all else fails, send an email to disa.meade.mae.list.pkieca@mail.mil

And PLEASE make a backup copy of the Certificate, even if you can re-download it. “Things” happen. Just do it. You will thank me later.

GO REPORT

Now comes the fun stuff. Go back to the website here: https://dibnet.dod.mil/portal/intranet/, and click that button to Report a Cyber Incident’. If you did everything right, you’ll get a form and all sorts of fun questions to fill out. If you did it wrong, you’ll get a “This site can’t be reached” error.

OK, NOW WHAT DO I HAVE TO KNOW TO REPORT

According to the regulations, you now get to play twenty questions! Luckily, we have a home version of the game as a consolation prize.

Get ready to provide as much of the following information as you can gather within 72 hours of the discovery of any cyber incident:

1. Company name
2. Company point of contact information (address, position, telephone, email)

Psshhht…you got this, it’s easy!

3. Data Universal Numbering System (DUNS) Number
4. Contract number(s) or other types of agreement affected or potentially affected
5. Contracting Officer or other types of agreement point of contact (address, position, telephone, email)
6. USG Program Manager point of contact (address, position, telephone, email)
7. Contract or other types of agreement clearance level (Unclassified, Confidential, Secret, Top Secret, Not applicable)
8. Facility CAGE code
9. Facility Clearance Level (Unclassified, Confidential, Secret, Top Secret, Not applicable)

Sure, you have this information memorized by now, right? Right now, these are the important things to gather, right?

10. Impact to Covered Defense Information

Yeah, this is the big one, please indicate how your breach is going to affect the US defense strategy. Don’t be shy! Lay out some worst-case scenarios for them. Get creative!

11. Ability to provide operationally critical support
12. Date incident discovered
13. Location(s) of compromise

Hopefully, these are ‘Yes’, the date (within 72 hours), and the location(s) of…your network? Your headquarters? Your business addresses? It may be the location of the PC that found the malicious code! Or is it your bathroom where you got the email? I seriously don’t know. Good luck.

14. Incident location CAGE code

I don’t know if this should be the same as the Facility CAGE code or not. I don’t. It should be looked at on a case-by-case basis.

15. DoD programs, platforms, or systems involved

This question is also going to require a bit of searching and discussion. Be as comprehensive as possible, but frankly, you really can’t nor don’t know.

16. Type of compromise (unauthorized access, unauthorized release (includes inadvertent release), unknown, not applicable)

I want to read a few of these for a laugh sometime. Apparently, “They got in and got our data” is NOT sufficient here. You’re going to need a good team effort here. This is going to require some forensic investigation and analysis. The reality is you may NOT be able to determine the type of compromise. These guys (and women) are good at what they do, they don’t leave a lot of clues or signs behind. It’s pretty much standard practice to erase log files and other evidence of entry into a system.

And what is ‘non-applicable’!? Since when is the type of compromise not applicable?

17. Description of technique or method used in cyber incident

If you knew this, wouldn’t you have prevented it from happening in the first place? But please, tell us how this could have been avoided.

18. Incident outcome (successful compromise, failed attempt, unknown)

“Well, the outcome was that we reported it to you”. Next question?

19. Incident/Compromise narrative

This is basically going to be the story of what happened. You should be complete and make sure that you understand what occurred, when it occurred, and how it showed up.

20. Any additional information

This is your opportunity, for good or bad, to put the incident in context by providing information that isn’t requested elsewhere.

REAL QUESTIONS THAT NEED TO BE ANSWERED

#1 Why should you need to go through a lengthy process, pay several hundred dollars just to be able to report a cyber incident? Why make it more difficult to report incidents?
#2 Why are there only two vendors that can issue this certificate (IdenTrust and WidePoint)?
#3 Why isn’t a High Assurance SSL from another vendor (at a lower price and less expensive) acceptable?
#4 Why do you only get ONE account?
#5 Why are you putting up barriers to people reporting cyber incidents?!

CONCLUSION

Follow the rules, do your best, and keep on trying to fight the good fight. RegDOX is always looking for good people…

About RegDOX Solutions Inc.

RegDOX Solution’s first-to-market ITAR and NIST 800-171 (DFARS) compliant online storage and collaboration product has redefined how export-controlled and CUI documents and electronic files can be handled within regulatory requirements. This was recognized by the formal opinion of compliance provided by the US State Department’s Directorate of Defense Trade Control (DDTC). RegDOX’s unique capabilities were confirmed on August 20, 2019 when the US Patent and Trademark Office issued a patent covering RegDOX’s system to store and manage export-controlled documents in the cloud. (Patent No. 10,389,716). The RegDOX® ITAR/EAR solution provides ground-breaking and unsurpassed technology enabling the efficiency and flexibility of a cloud solution to allow multiple users located at numerous locations to collaborate using controlled data while remaining fully in compliance with the strict regulatory and licensing requirements of the ITAR and DFARS.

www.RegDOX.com

Today’s article in the Wall Street Journal titled Hacker Group Says It Accessed Tesla’s, Others’ Internal Video-Surveillance Feeds reminds us of the increasing cybersecurity risks to businesses of video conferencing. RegDOX’s whitepaper on CUI and the Risk of Third-Party Sharing Apps addressed this risk and proposed some steps companies can take to protect their confidential information. You can download that whitepaper here.

The basic federal requirements for safeguarding Controlled Unclassified Information (CUI) in nonfederal systems have relied for some time now on the 110 controls within NIST SP 800-171 rev.2 (February 2020). The National Institute of Standards and Technology (NIST), in response to advance persistent cybersecurity threats, has now released an important supplement to SP 800-171 designated as NIST SP 800-172.

This 84-page supplement is intended to enhance the previously existing SP 800-171 confidentiality controls as well as to provide additional integrity and availability protections for CUI. It applies to all nonfederal systems that agencies determine are processing, storing, or transmitting CUI associated with a critical program or high-value asset, as well as system components that provide protection to such systems.[†]

The new security requirements may be selectively applied by federal agencies implementing the new SP 800-172 standards. We expect the new requirements to start to show up in federal RFPs and contracts.

Similar to SP 800-171, the purpose, target audience, and fundamentals of the development approach for the new SP 800-172 controls are contained in chapters one and two of the publication. The specific enhanced requirements also build on SP 800-171 by relating to the same 14 categories of controls that are contained in chapter 3 of the earlier publication.

Also similar is Appendix C to SP 800-172, which maps the enhanced controls to the security controls contained in NIST SP 800-53 rev. 5 (dated September 2020) following the approach found in Appendix D of SP 800-171. SP 800-53 of course sets out mandatory minimum controls for federal information systems.

The enhancements of SP 800-172 promote the protection of CUI through additional controls for penetration-resistant architecture, damage-limiting operations, and designs in order to achieve greater cyber resiliency and survivability. Of the original 14 families of security requirements found in SP 800-171, enhancements have been made to the following 10 categories:

3.1 Access Control
3.2 Awareness and Training
3.4 Configuration Management
3.5 Identification and Authentication
3.6 Incident Response
3.9 Personnel Security
3.11 Risk Assessment
3.12 Security Assessments
3.13 System and Communications Protection
3.14 System and Information Integrity

Care should be taken to both completely understand the changes in SP 800-172 and how they affect your organization. This may be achievable through your internal resources or can be accomplished with the assistance of subject matter experts such as RegDOX Solutions.

It is acknowledged in SP 800-172 that “[c]ertain enhanced security requirements may be too difficult or cost-prohibitive for organizations to meet internally…. [and that] the use of external service providers can be leveraged to satisfy the requirements.”[‡] Included among those are those relating to threat intelligence, threat and adversary hunting, system monitoring and security management, IT infrastructure, platform and software services, threat, vulnerability, and risk assessments, response and recovery, and cyber resiliency.

RegDOX, with its ITAR and DFARS-compliant secure data storage and collaboration platform for CUI, can both jump-start and also ensure continuing compliance by organizations in satisfying these requirements. Contact us through our website at www.RegDOX.com or call 1-800-517-3171 and we will be glad to explain how.

About RegDOX Solutions Inc.

RegDOX Solution’s first-to-market ITAR and NIST 800-171 (DFARS) compliant online storage and collaboration product has redefined how export-controlled and CUI documents and electronic files can be handled within regulatory requirements. This was recognized by the formal opinion of compliance provided by the US State Department’s Directorate of Defense Trade Control (DDTC). RegDOX’s unique capabilities were confirmed on August 20, 2019 when the US Patent and Trademark Office issued a patent covering RegDOX’s system to store and manage export-controlled documents in the cloud. (Patent No. 10,389,716). The RegDOX® ITAR/EAR solution provides ground-breaking and unsurpassed technology enabling the efficiency and flexibility of a cloud solution to allow multiple users located at numerous locations to collaborate using controlled data while remaining fully in compliance with the strict regulatory and licensing requirements of the ITAR and DFARS.

www.RegDOX.com

[†] Covering system components including mainframes, workstations, servers, input and output devices, cyber-physical components, network components, mobile devices, operating systems, virtual machines, and applications.

[‡] Quoting SP 800-172, page 10.

The Office of the Under Secretary of Defense for Acquisition and Sustainment has released a formal instruction on cybersecurity for acquisition authorities and program managers that was effective on December 31, 2020. This document is referred to as DoD Instruction 5000.90 and can be found here. DoDI 5000.90 supersedes portions of the July 2020 issued DoD Instruction 500.83.

Much of DoDI 5000.90 deals with policies, responsibilities, and procedures within the DoD for the management of cybersecurity risk acquisitions. Companies within the Defense Industrial Base (DIB) should familiarize themselves with all the instructions. However, the concluding section 3.4 titled, “Cybersecurity in the Supply Chain”, is of particular relevance to direct (prime) and indirect (subcontractors) DoD suppliers.

Section 3.4 needs to be reviewed in depth to get an understanding of the DoD’s expectations for suppliers, but in summary, it sets out several important requirements. The first is minimal Supply Chain Risk Management (SCRM) reviews including cyber-related SCRM reviews of vendors to address such issues as,

DoD Program Managers (PMs) are also required under section 3.4 of DODI 5000.90 to seek alternatives to foreign sourcing of program components (hardware, software, or firmware) from commercial companies owned or under the influence of adversarial foreign governments. These instructions to DoD PMs should be understood by the DIB as defining acceptable, unacceptable, and risky suppliers of hardware and software involved in DoD contracting throughout the supply chain.

At RegDOX, we welcome the opportunity to discuss not only these requirements, but any changes, past, present, or future. Our job is to help you harden your cybersecurity infrastructure to ensure that these increasingly strict requirements do not threaten your DoD-related business.

About RegDOX Solutions Inc.

RegDOX Solution’s first-to-market ITAR and NIST 800-171 (DFARS) compliant online storage and collaboration product has redefined how export-controlled and CUI documents and electronic files can be handled within regulatory requirements. This was recognized by the formal opinion of compliance provided by the US State Department’s Directorate of Defense Trade Control (DDTC). RegDOX’s unique capabilities were confirmed on August 20, 2019 when the US Patent and Trademark Office issued a patent covering RegDOX’s system to store and manage export-controlled documents in the cloud. (Patent No. 10,389,716). The RegDOX® ITAR/EAR solution provides ground-breaking and unsurpassed technology enabling the efficiency and flexibility of a cloud solution to allow multiple users located at numerous locations to collaborate using controlled data while remaining fully in compliance with the strict regulatory and licensing requirements of the ITAR and DFARS.

www.RegDOX.com

RegDOX provides a specialized, secure file sharing application that is hosted on Amazon’s AWS GovCloud and meets or exceeds all DoD requirements, including NIST SP 800-171a, CC SRG Impact Level 4^[1], and the FedRAMP Moderate Baseline. RegDOX will assist in every way we can with any cyber incident reporting, including immediately responding to and tracking events, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment. All of this will be reported to affected customers.

DFARS clause 252.204-7009 specifically provides certain use and confidentiality restrictions on information obtained from a third-party’s report of a cyber incident under DFARS clause 252.204-7012.^[2] DFARS clause 252.239.7010 also requires that RegDOX’s cloud service satisfies the requirements of that clause and NIST SP 800-171, which it certainly does.

The substance of the DFARS reporting requirement is contained in DFARS clause 252.204-7012. RegDOX’s System Security Policy is a comprehensive document detailing all contingency planning.

This is the portion specifically dealing with Cyber Incident Reporting:

As a reflection, due to the robust security protections incorporated into the RegDOX system (among other protections), there have been no cyber incidents in the history of the company. This statement however stands as the standard by which RegDOX will support its clients and meet the DFARS requirements for any such incident.

About RegDOX Solutions Inc.

RegDOX Solution’s first-to-market ITAR and NIST 800-171 (DFARS) compliant online storage and collaboration product has redefined how export-controlled and CUI documents and electronic files can be handled within regulatory requirements. This was recognized by the formal opinion of compliance provided by the US State Department’s Directorate of Defense Trade Control (DDTC). RegDOX’s unique capabilities were confirmed on August 20, 2019 when the US Patent and Trademark Office issued a patent covering RegDOX’s system to store and manage export-controlled documents in the cloud. (Patent No. 10,389,716). The RegDOX® ITAR/EAR solution provides ground-breaking and unsurpassed technology enabling the efficiency and flexibility of a cloud solution to allow multiple users located at numerous locations to collaborate using controlled data while remaining fully in compliance with the strict regulatory and licensing requirements of the ITAR and DFARS.

www.RegDOX.com

________________________________________
^[1] Vol. 1, Release 3, Department of Defense Cloud Computing Security Requirements Guide (March 6, 2017).
^[2] DFARS clause 252.204-7009(b) Restrictions.

Before evaluating a build versus buy discussion for any commercially available software or cloud application, the discussion should begin with the question “what exactly is the need?” In other words, “what is the use case for the solution?”

When the use case is compliance with a set of complicated and demanding regulations and cybersecurity standards, such as the Defense Federal Acquisition Regulation Supplement (DFARS), the International Traffic in Arms Regulations (ITAR), and NIST SP 800-171 governing the possession and handling of federal Controlled Unclassified Information (CUI), answering the build vs buy question can be particularly demanding.

A useful analysis considers not just the necessary internal assets, required personnel, needed features, and goals of project stakeholders, but also requires a complete understanding of those regulations and where they are headed.

By necessity, this understanding of the legal requirements will go beyond whether an internal development will be timely, cost-effective, and achieve the needs of stakeholders, but also whether the immediate and future results of the development will fulfill the expressed and intended scope of the regulatory or compliance concerns related to the information. Without that being achieved, the best run development project will efficiently produce a solution that is worthless.

This paper will start with an analysis of whether to build or acquire an ITAR or CUI compliant storage and collaboration solution by first laying out the evaluation framework using the traditional factors of Cost, Control and Maintenance. Then, it discusses how an organization considering an internal ITAR or CUI development model will need to achieve the requisite regulatory knowledge and experience for that development, and then remain current on those regulations throughout the use of the internally developed solution.

Cost of Internal Development vs. Acquisition

No business wants to spend more money than necessary to have a working IT solution. Unfortunately, some real costs are often not considered in the decision-making process. Purchasing software can have an upfront cost (or subscription fee) that may seem expensive by contrast with the use of existing resources, but the expense is known, and the product compliant and ready to use very quickly.

But are all the costs of redeploying existing programming resources and launching an internal solution known and calculated correctly? Let’s look at some often overlooked or less than completely analyzed areas when determining real costs:

Immediate Development Staff Costs: Good software requires more than just programming talent. At a minimum, those line programmers must be joined in their efforts by project planners, software architects, senior management code programmers/developers, database architects and administrators, quality assurance personnel, application testers, and the administrative support and associated managers of all those teams. Even during the initial development, changes, enhancements, and new functionality are common in any development process. The less thorough the scoping of the project, the more those unknowns will surface.

Likewise, not usually planned, but always existing are the hours and hours of often unplanned or inaccurately planned debugging, scope creep, redeployment or loss of personnel resources, and budgetary pressures. It is little wonder that Gallup has reported that one out of every six IT projects have a cost overrun of 200% and a time overrun of almost 70%.¹ Some, of course, miss more widely on unplanned costs and delays than that found by Gallup.

Do you have a user experience team on staff? What about application designers? Does anyone in your organization know the possibilities and needs of a virtual data room solution addressing ITAR and CUI compliance? How strong and knowledgeable is your security team? The answers to all those questions have to be emphatically in the affirmative or the effort will be at best, at risk and at worst, a preordained failure.

Designing and building this kind of software requires more than just reassigning existing programmers or hiring an offshore team to build a scoped project. What if the technology you thought would be suitable turns out not to be sufficient? What if you need to find highly skilled or specialized employees or contractors? What happens when the technology changes? Better solutions or more efficient solutions are constantly being developed.

Long Term Support, Maintenance, and Upgrades Staff Costs: And the unknowns can multiple. If the developers that build your application leave the company, will new people be able to understand the code, address bugs, and make improvements in a timely fashion? Will those developers be available later to provide the user support, maintain the solution in an ever-changing IT infrastructure, and provide upgrades to address additional user and regulatory demands? Can it even be known how much additional work this will cause, thus challenge budgetary assumptions?

Technology Costs: There are numbers of instances where a project began using an expensive technology platform, only to discover there was a better, less expensive open-source alternative. Conversely, an organization will choose an open-source technology without fulling understanding the costs and challenges in staffing the project (as well as the limits and requirements of related technology licenses). In either instance, these technology platform issues can cause both substantial additional costs, delays, or both.

Time Costs: If a company wait to build an application, how much potential revenue will be lost while until the development is completed? What are the costs of continued regulatory non-compliance from forgoing an existing solution in favor of one internally developed, but not available during the interim? The revenue loss of being unable to address ITAR and CUI related opportunities or, perhaps even worse, suffering non-compliance penalties and fines that would not have occurred with the use of an off-the-shelf solution could far exceed the payment for a license or service subscription. When calculating return on investment (ROI), all factors need to be considered, including those associated with such a risk.

Controls for an Internally Developed Solution

One of the most popular reasons for building an inhouse solution is the company having control over the application. However, this means that the company is always going to be responsible for hosting and maintaining the application, as well as relying on the development team to make any changes or improvements to the solution. With an available commercial solution, there often is the advantage of getting exactly what is wanted or needed now, and achieving that at a fixed cost for hosting and supporting the solution.

Additionally, an internally developed solution is frequently subject to renewed or extended development as internal constituencies with access to programming resources are looking for more.
“Scope creep” is where a planned project starts to stray from its original intended purpose, and other parties want you to add a function or build something on top of the application. Scope creep can be devastating if not managed properly – and it rarely is when building inhouse. A big part of scope creep comes when a company realizes the newly developed system needs to work with other systems being used. It’s never as easy as it sounds.

As an example, Customer Resource Management (CRM) solutions aggregate customer data -which seems straightforward. It builds some forms, saves customer name, address, phone number, email, website, and some other bells and whistles. Easy enough – now we’re done!

But wait! What about sending emails out of the CRM from a sales team’s email addresses? What about modifying the design and content of those emails? What if the sales team wants to automate those tasks based on user requests? What if they want to integrate calendars? Management wants to watch our sales numbers, so integrating the CRM with accounting or ERP software becomes a requirement for the project.

That simple CRM now has tremendous scope creep. Not because it was not scoped appropriately, but because people wanted to use the system for more or improve the current processes or systems. This scope creep folds right into the development goals of a third-party provider of the system as it seeks to make a product as useful to the market as possible, sometimes by only adding niche requirements that nonetheless can attract user interest. Scope creep for a company-specific solution however cannot be leveraged across a market but involves costs that have to be absorbed by one company.

Once the internal application is built, the integration is needed so that it can talk to our other systems. Building a solution allows you to integrate with the current technology ecosystem, but that can change as well. How many databases and code bases do an IT department want to support?

Maintenance of an Internally Developed and Supported Solution

Experience shows that the third traditional factor of maintaining an internally developed solution can quickly expose a company to what is more a curse than a blessing. While additional third-party cost for a service contracts is perhaps avoided, although not in all instances as hardware and software must be obtained to support an internally developed solution, the involvement of a company’s people is still going to be a cost measured as time spent that could have addressed other projects or IT needs, as well as in money. Maintenance and support and security are a 24/7/365 requirement. Pulling resources away from current projects can have far-reaching effects on other aspects of the organization.

Other parts of maintenance include updating the system, creating enhancements, improving the system and securing the system. These require a company’s team to constantly spend time staying up to date on the latest and greatest technology to keep an internal solution current and operable – in addition to their regular responsibilities. More than likely, your company does not have the experience in building this level of complex applications. This is when you turn to a company that knows the industry, the regulations, and the nuances.

Lack of Regulatory Expertise

Having expertise in all aspects of a software is nearly impossible, but it’s just one aspect of a company’s risk when undertaking development of an internal solution. Legal ramifications, compliance requirements, and privacy concerns are not usually skills developers possess. Failure to address these factors can make your project unusable. Is the software Sarbanes-Oxley compliant? If not, no public company will buy it. Will it satisfy the requirements of the ITAR, NIST special publication 800-171, and the Defense Department’s Cloud Computing Security Requirements Guide, or the evolving standards underlying the DoD’s Cybersecurity Maturity Model Certification (CMMC) framework? If the answer to all of that is less than an emphatic Yes!, the effort is not just worthless, but dangerous to the company.

Training also must play a part in your decision. If an application is very complex, a company will need to spend a lot of time training people and integrating the process and procedures into its current system. This may require hiring more staff that is more experienced with the new technology.

Costs, Risks, and Loss of Functions Avoided by Not Seeking to Replicating the Focus of RegDOX’s ITAR and CUI Solution

RegDOX’s focus is on using its leverage across multiple customers to ensure both ongoing ITAR and CUI compliance and providing its solution without the risk of non-compliance and at price and level of functionality that cannot be replicated by any one company for its internal use. The success of this effort is demonstrated by its approval by the Directorate of Defense Controls, the agency that has issued and enforces the ITAR, and its numerous and growing number of patents covering its application. This success is the product of many working years of development and a deep expertise in the ITAR and requirements for CUI.

The bottom line for any company considering programming its way to ITAR or CUI compliance is that seeking to replicate what RegDOX’s does best is not only going to be more expensive when considering all upfront, ongoing and hidden costs, but the effort will bring greater risk of non-compliance and many fewer features and functions.

¹ September 11, 2011, Why Your IT Project May be Riskier than You Think, Harvard Business Review 89(9):23-25.

About RegDOX Solutions Inc.

RegDOX Solution’s first-to-market ITAR and NIST 800-171 (DFARS) compliant online storage and collaboration product has redefined how export-controlled and CUI documents and electronic files can be handled within regulatory requirements. This was recognized by the formal opinion of compliance provided by the US State Department’s Directorate of Defense Trade Control (DDTC). RegDOX’s unique capabilities were confirmed on August 20, 2019 when the US Patent and Trademark Office issued a patent covering RegDOX’s system to store and manage export-controlled documents in the cloud. (Patent No. 10,389,716). The RegDOX® ITAR/EAR solution provides ground-breaking and unsurpassed technology enabling the efficiency and flexibility of a cloud solution to allow multiple users located at numerous locations to collaborate using controlled data while remaining fully in compliance with the strict regulatory and licensing requirements of the ITAR and DFARS.

www.RegDOX.com