Security Executive Blog

It’s a common practice to allow employees to use enterprise computers outside of the enterprise. This has become more common where employees are increasingly working at home. Though a common practice, these occurrences are not always best practices. Anytime an employee leaves work with a company computer, the expectation is that all information is vulnerable. Malware, ransom ware “supply chain attacks”, hacking and other threats are prevalent. In many cases this can be controlled through applying NIST standards and strong cybersecurity measures. This article will focus on limiting use of loaned laptops and not on technical cybersecurity application. The organization should assign a strong risk assessment based on use prior to assigning company computers for at home use. This risk assessment should limit the information to be provided and for specific purposes. For example, if a user works on a specific project, then the laptop might only contain information for that specific use. The l...

A buzz is sweeping the security community since the industry has been notified of the recent updates to DoD's CUI program based on the presidential memorandum with the subject,  Designation and sharing of Controlled Unclassified Information (CUI) . This memorandum implements a program designed to encourage the speedy sharing of information to those authorized and to better protect the information, privacy and legal rights of Americans. The CUI program is designed to promote proper safeguarding and dissemination of unclassified information.       Many readers may be familiar with the program CUI has replaced. Sensitive But Unclassified (SBU) information had enjoyed protection to a certain level but was not conducive to the necessary information sharing. Controlled Unclassified Information (CUI) directives provide procedures for a more appropriate Information Sharing Environment.     CUI is a designation of unclassified informati...

A buzz is sweeping the security community since the industry has been notified of the recent updates to DoD's CUI program based on the presidential memorandum with the subject,  Designation and sharing of Controlled Unclassified Information (CUI) . This memorandum implements a program designed to encourage the speedy sharing of information to those authorized and to better protect the information, privacy and legal rights of Americans. The CUI program is designed to promote proper safeguarding and dissemination of unclassified information.       Many readers may be familiar with the program CUI has replaced. Sensitive But Unclassified (SBU) information had enjoyed protection to a certain level but was not conducive to the necessary information sharing. Controlled Unclassified Information (CUI) directives provide procedures for a more appropriate Information Sharing Environment.     CUI is a designation of unclassified informati...

The Defense Counterintelligence and Security Agency (DCSA) is responsible for evaluating vulnerabilities of classified information at a Cleared Defense Contractors (CDC) facility. This includes not only the policy to review a contractors capability to protect classified information, but now includes the handling and protection of items identified as well as controlled unclassified information (CUI). If it appears that there are acronyms developed to cover concerns at an alarming rate, you are correct. The vulnerabilities of technology that enhances our military capability also comes with a set of warnings and new titles and acronyms that demand increased attention. We have critical program information, critical components, critical technologies, controlled unclassified information, and etc. Each one with similar yet different definitions and requirements. While we may have new names and acronyms, the fundamentals of protection remain. As detailed above, it is evident that tech...