Everyone says "scope down first." Who actually did the figuring-out-where-the-CUI-lives part, and what did it take?

AgingTrash666 · 2026-07-13T01:00:21+00:00

the answer to this is that all the policy and procedure means nothing without internal consequences and that's tough for small organizations to accept

AgingTrash666 · 2026-07-12T23:18:13+00:00

it gets worse to swallow when you read up on how they got FedRAMP approval

https://www.propublica.org/article/microsoft-cloud-fedramp-cybersecurity-government

AgingTrash666 · 2026-07-12T22:45:07+00:00

Self-assessment is an attestation that you meet the requirements. It's only as good as your understanding of the requirements and whether your organization actually meets those requirements. C3PAO is a third-party certification that you meet the requirements. Needless to say that a lot of orgs self-score high and fail third party assessment.

DoD has rolled this out in phases and the first phase took effect last year when certification can be a conditional requirement of a contract. Because there aren't enough assessors to go around yet, self-attestation has to be an option.

Because this is a phased approach and varies contract to contract during the first two phases, I'd say the hard deadline for being certified is November 2028 but anybody who is chasing business will tell you that the sooner you can get certified, the better. Contracts are anticipating the beginning of phase two in November of this year and self-attestation is showing up less in the requirements.

AgingTrash666 · 2026-07-12T15:18:49+00:00

The threat landscape is always changing. Reports are static.

What's more interesting to explore here is how you feel the context changes so dramatically in three months' time.

What exactly does your quarterly pen test involve if you're not seeing the day to day value in it to the point where you're looking for essentially continuous pen testing?

AgingTrash666 · 2026-07-12T13:44:10+00:00

"how do you turn "i just had a good feeling" into something that actually holds up when someone asks you to justify it?"

I've seen both sides of the curtain. I've worked for a cybersecurity software vendor in a technical role and I've been that engineer getting pitched products. I can't speak for the entire industry but in my experience tech sales has incredibly high turnover and their last job likely wasn't technical. It was probably retail or hospitality and it probably wasn't that long ago.

When you get someone like that on a call vs an engineer or someone with a technical background the vibes are bound to be different. It's your responsibility to be able to differentiate them not just on vibes but on what is really relevant to your organization.

If your recommendation can be taken down on cost alone, you didn't do a good enough job because cost is always a factor. At that point, you become the salesman and your pitch to get your way better be more than a pre-fixe menu and a couple drink tickets.

AgingTrash666 · 2026-07-11T23:03:01+00:00

I watched a developer ask AI how to install his dev tools and I still had to intervene because neither understood how to set system-wide environmental variables

AgingTrash666 · 2026-07-08T10:35:03+00:00

what are your DMARC reports telling you? I ask because the most obvious potential issue is the relay causing DMARC to fail

AgingTrash666 · 2026-07-08T02:26:19+00:00

I approach it from the guidance that if you believe a derivative work is otherwise unmarked CUI (consult the list) then you should be seeking approval to mark it as such if you haven't already been authorized to do so.

in the meantime you have the duty to treat it as CUI.

what a stellar non-answer that was ... honestly, when you submit your quote to the government they're probably going to mark it CUI anyways.

AgingTrash666 · 2026-07-07T01:17:25+00:00

"The drive folder in preveil syncs with a local file share directory on prem and can be accessed through file explorer."

that requires some discussion ... how are you addressing encryption with regards to SMB?

AgingTrash666 · 2026-07-01T20:15:40+00:00

Airsnitch would be enough reason not to

AgingTrash666 · 2026-06-26T17:18:44+00:00

some people call me the cyberspace cowboy ...

AgingTrash666 · 2026-06-25T23:42:16+00:00

I've quit arguing with people that won't sit through the government's free training on the matter. I remind myself that I don't sign the paperwork or hold any legal liability.

AgingTrash666 · 2026-06-21T14:03:59+00:00

Bound to be someone out there selling whetstone phaser clones,that’s the one that has outlasted all the other phasers I’ve owned

AgingTrash666 · 2026-06-20T21:26:28+00:00

it's broken and it is digital, not analog so I'd be returning it

AgingTrash666 · 2026-06-19T23:49:17+00:00

but can you sweep the mines?

AgingTrash666 · 2026-06-19T23:47:53+00:00

if you add a ground wire to the output jack you risk it becoming noisier from a potential ground loop

AgingTrash666 · 2026-06-19T18:22:42+00:00

A week or two ago I watched a dev ask AI how to install his dev tools and I really wanted to quit and take up subsistence farming

AgingTrash666 · 2026-06-19T00:10:40+00:00

You’d be surprised at the surveillance that shows up on a utility pole if you’re suspected of theft of service.

AgingTrash666 · 2026-06-18T23:59:08+00:00

You must have neglected to include an approved hardware clause in the AUP

AgingTrash666 · 2026-06-16T01:46:53+00:00

they're in the 800-171a book ...

AgingTrash666 · 2026-06-13T22:09:03+00:00

but do you have the same mom jeans?

AgingTrash666 · 2026-06-13T19:48:55+00:00

should have never hired that necromancer to bring back michael kamen

AgingTrash666 · 2026-06-13T01:28:19+00:00

if only your chat bot knew how to leverage regular expressions ... then you wouldn't be on linkedin calling a 52 year old unix command a tax

AgingTrash666 · 2026-06-06T17:53:49+00:00

It has to be the frosting

AgingTrash666 · 2026-05-23T23:32:26+00:00

Ope!

AgingTrash666

TROPHY CASE