Kendall S.

You've been told to harden your systems. NIST 800-171 Rev 3 demands it. Your CMMC Level 2 assessor is going to ask what baseline you chose - not whether you chose one, but *what* you chose. So you pull up two tabs. Left: DISA STIGs. Right: CIS Benchmarks. Both claim to solve your problem. Both have defenders who'll argue loudly at conferences. Here's what nobody tells you upfront: picking the wrong framework doesn't just waste time. It creates a gap between what your tools automate and what your assessor expects to see. The fracture lines: → STIGs cover specialized DoD middleware (IBM WebSphere, Red Hat JBoss, F5 BigIP) that CIS doesn't touch → CIS provides explicit benchmarks for AWS, Azure, and GCP - actual cloud platform guidance → STIGs ship as machine-readable XCCDF files. CIS Benchmarks? PDFs. → Getting CIS into your CI/CD pipeline means purchasing SecureSuite membership The reality most defense contractors face: you're running both. On-prem Windows servers alongside AWS workloads. Legacy middleware next to cloud services. The practical approach that's emerging: Apply STIGs to defense-specific components. Use CIS Benchmarks for cloud workloads and commercial SaaS. Document the rationale. Show your assessor why each component got the baseline it got. Here's the number that should reassure you: organizations commonly implement 20 - 50% fewer STIG controls than the full baseline after tailoring for operational requirements. That's not noncompliance. That's what tailoring means. Control 3.4.2 doesn't care which baseline you choose. It cares that you *chose* one, implemented it, and can prove it works. The frameworks exist. The tooling exists. The mapping between them exists. What doesn't exist yet, for too many contractors, is the decision. And your assessor isn't going to make it for you. #CMMC #CMMCLevel2 #NIST800171 #STIGvsCIS #DefenseContractors #Cybersecurity #ComplianceAutomation #SystemHardening Full breakdown: https://lnkd.in/gpFYWF9b

6

CISA has told federal agencies to stop using Gogs or immediately apply mitigations after adding a high-severity vulnerability in the self-hosted Git service to its Known Exploited Vulnerabilities (KEV) catalog. More: https://lnkd.in/dUKNCFfz #CISA #US #cybersecurity

2

Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers

17

2 Comments

👍ToolShell: CISA’s Warning to Federal Agencies About a New Remote Code Execution Vulnerability. Last week, CISA issued an alert for CVE-2025-53770, publicly reported as “ToolShell.” It’s a critical remote code execution (RCE) vulnerability actively being exploited in on-premises deployments of Microsoft SharePoint. The vulnerability impacts several SharePoint versions (2019 and Subscription Edition). It allows an attacker to execute arbitrary code with elevated privileges and with no user interaction required. This means attackers don’t need to social engineer the breach. They just need to find a way in. https://lnkd.in/gp_5uQyW

1