Partner Onboarding

Resilience in Action: Your Guide to DIB-VDP Readiness

Kelly Salisbury and Damia Sharp, DC3 VDP

Program covering what is DIB-VDP, coverage of our dual sealed products to include an overview of the DCSA and DCISE collaboration and partnership. Our team will cover the "life of a ticket," technologies used, data analysis (trajectory, month -to -month view), and CVE/CWE impact for DIBCOs. We will also highlight the top CVEs and CWEs, researcher and stakeholder engagement, and other relevant articles, presentations, and RFIs (including press releases, congressional taskers, and a Wall Street Journal article). We will cover the DIB-VDP Pilot Feasibility Study, lessons learned from the Pilot, best practices, Real testimonies, Metrics that Matter to reflect a high-level program overview, and lastly cover the benefit of having working relationships with the DIBCOs companies (feedback survey), and give the onboarding process (white glove support) followed by a call to action, and Q&A.

Small/Med DIB Partner Track

Demystifying CMMC: Navigating Compliance and Achieving Certification

Katie Dodson, Hive Systems Defense Solutions

The Cybersecurity Maturity Model Certification (CMMC) is a critical framework for organizations operating within the Defense Industrial Base (DIB). Noncompliance will result in the loss of Department of Defense (DoD) contracts worth millions of dollars, but understanding the complexities of CMMC and successfully navigating a Certified Third-Party Assessment Organization (C3PAO) audit can be challenging.

This session, led by Katie Dodson, a Lead Certified CMMC Assessor (CCA), will provide a comprehensive overview of CMMC for companies of all sizes. She'll break down key requirements across different maturity levels and outline actionable insights into preparing for an assessment.

Attendees will gain practical knowledge on:

• Key CMMC domains and controls
• Common pitfalls and challenges organizations face
• Best practices for achieving and maintaining compliance
• The C3PAO assessment process: what to expect and how to prepare
• Strategies for a successful audit outcome

Whether you're just starting your CMMC journey or are preparing for an upcoming assessment, this presentation will equip you with the tools and understanding needed to navigate the compliance landscape with confidence.

Doing More with Less: Using Automation to Increase Cybersecurity Capabilities and Drive Efficiencies in the Absence of Manpower and Money

Jess Parnell and Kristen DeBruler, Georgia Tech Research Institute (GTRI)

The Georgia Tech Research Institute (GTRI) will discuss how it implemented Security Orchestration, Automation, and Response (SOAR) to automate processes within our Security Operations Center (SOC), enhancing cybersecurity defenses while addressing budgetary and talent constraints. In doing so, GTRI will demonstrate how this approach has increased in capabilities, greater responsiveness to customers, reduced errors, and enhanced defenses by greatly reducing our detection and response times in areas such as suspicious emails, foreign travel, and security misconfigurations.

CMMC – Its origins AND why YOUR company needs to act

Shawn D. Dickman, Col USAFR, DTC, LLC

Mr. Dickman presents the story of the agencies involved in the discovery of US IP theft, the NCIJTF's early analysis, and the resulting whole -of- government approach for enhancing cybersecurity across the DIB. The discussion focuses on China and their relentless pursuit of hacking to advance their military and industrial procurement activities. The legislative walk-through regarding USG acquisition regulations provides context for exactly what CMMC is and is not.

Threats

Reducing Risk from Edge Device Exploitation

Emily Skahill & Chris Schmaltz, CISA

The exploitation of edge devices represents a growing cybersecurity threat, with Verizon's annual Data Breach Investigation Report noting that the percentage of edge devices and VPNs targeted increased eightfold from 2023 to 2024. Edge devices are attractive targets for attackers because these appliances are internet accessible, provide a good initial access point, and have limited Endpoint Detection and Response (EDR) visibility, making them blind spots for security teams. Cyber actors from the People's Republic of China (PRC) cyber actors have proven particularly adept at identifying and exploiting vulnerabilities in edge devices.

Tools

Shared Secrets: Hunting credentials and PII in open file shares

Brandon Helton, L3Harris Technologies

This presentation will highlight how automated tools can rapidly scan thousands of open file shares to uncover exposed credentials and sensitive PII. We'll focus on how common development missteps - like storing secrets in web application configuration files and CI/CD pipelines - can lead to serious data exposure and security risks. Attendees will gain insight into the scale of these risks as it pertains to our company and how to detect and remediate them effectively.

Denial & Deception Technologies - A Success Story

Ben Loveless, Safran Defense & Space, Inc.

Discover the power of Denial & Deception (D&D) techniques in cybersecurity with our presentation. We will showcase our deception tools, highlighted during a targeted penetration test, where they achieved no false positives and evaded detection by skilled pen testers. Utilizing Thinkst Canary appliances and tokens, our approach deploys decoy systems across VLANs and physical locations, mimicking critical assets like servers and routers, while strategically placed tokens, such as deceptive Office files and AWS API keys, create tripwires throughout the network. Highly cost-effective, these tools are accessible to the SMB space, providing real-time, high-fidelity alerts for both external threats and insider risks. We’ve further extended and enhanced their impact with custom API integrations with firewalls and Active Directory, enabling automated responses such as dynamic blocking and account disabling. Join us to learn how these innovative, last-resort defenses can fortify your network security with minimal risks and low investment.

Puzzled Prince: Enhancing Payload Weaponization

Cullen Rezendes, DC3 CFL

Puzzled Prince is a modular payload weaponization platform that aims to provide evasion and loader mechanisms for a target payload built on the practical experience of threat actor capabilities. Puzzled Prince seeks to address the difficulties that adversary emulation operators face when needing to constantly modify their payloads as security vendors continuously update their products. An operator can enhance their payload by wrapping it with numerous evasion techniques, including shellcode/string encryption, EDR evasion techniques, sleep/delays, sandbox evasion, and more. Additionally, Puzzled Prince can assist operators in loading their payloads into memory via DLL hijacking, HTML Application (HTA) loaders, COM hijacking, Microsoft Word loaders, and more.

DCISE³ vs ENSITE, A Comparative Analysis

Alan Savage and Nicholas Roesch, DC3 DCISE, OED

DCISE³, ENSITE, Firewalls, Sensors, what does it all mean? Let us guide you through both of these DC3 capabilities and demonstrate how they complement each other. By the end, you should be able to fully understand these capabilities and how they help you meet specific NIST SP 800-171 requirements.

Down the Rabbit Hole - Community Analytics from the DCISE³ Platform

John DiGerolamo, Celerium, Inc.

The DCISE³ Program allows DCISE analyst teams to view near-real time traffic data across hundreds of DIB company network gateways. This coupled with commercial intel provided by technology partner Celerium allows these teams to provide meaningful context and weight to their findings and enables them to track and respond to DIB-specific threats and attacks. This presentation highlights primary examples of how the DCISE³ Program makes this possible.

Navigating the Security Landscape of AI (LLMs, RAG and MCP)

William Glodek, BreakPoint Labs

The presentation discusses the integration of Artificial Intelligence (AI) technologies, specifically Large Language Models (LLMs), Retrieval-Augmented Generation (RAG), and the Model Context Protocol (MCP), within the cybersecurity domain. It highlights the dual nature of these technologies, acknowledging their potential to revolutionize workflows and processes while simultaneously introducing novel vulnerabilities such as prompt injection, data poisoning, and the disclosure of sensitive information . Tailored for cybersecurity professionals, the presentation aims to define these core technologies, analyze principal LLM security vulnerabilities (referencing the OWASP Top 10 for LLMs), detail specific RAG system security challenges, and explain MCP's purpose in standardizing context management, alongside its security implications. Furthermore, it will illuminate the security considerations for integrated AI systems, outlining attack vectors and mitigation strategies.