This section explores artificial intelligence, cybersecurity, autonomous systems, software engineering, and federal technology modernization. White papers covers artificial intelligence, cybersecurity, autonomous systems, applied systems engineering, and federal technology modernization. The collection includes technical articles, implementation guidance, architecture discussions, and white papers based on real-world engineering and operational experience.
-
Accelerating Federal Authorization Through Agentic Assessment
Executive Summary Agentic workflows can materially reduce the time required to prepare and assess federal authorization packages by turning large volumes of system information into a traceable assessment record. The approach described in this paper has been implemented and tested across the full authorization workflow. The results show that a governed agentic system can perform…
-
Engineering a Reliable, Virtualized, Fully Agentic Pentest Platform Through Loop Engineering
Executive Summary CyberOps is a reliable, stable, fully agentic penetration-testing platform built utilizing loop engineering. It coordinates a real offensive toolkit across long-running authorized missions, maintains durable mission state, and turns tool output into structured evidence and analyst-grade findings. The platform is virtualized: the same core architecture can run on premises or in cloud infrastructure,…
-
AI Vulnerability Discovery and the Case for Systems Security Engineering
For decades, the approach to building technology has operated on an implicit assumption that security could be addressed after the fact. Organizations built systems to meet functional requirements, shipped them when they worked, and addressed security through periodic assessments, patching, and monitoring. The economics of the threat environment supported this approach. Vulnerability discovery was expensive,…
-
A Case Study in AI Assisted Development and Rapid System Delivery
Building a Production Quality, NIST SP 800 53 Rev. 5 Aligned Tabletop Exercise Platform in Approximately Four Hours of Active Work Executive Summary I built a production-ready cybersecurity tabletop exercise platform in approximately four hours of active work spread across two days. The application includes a live multiplayer exercise engine, AI-generated scenarios, three AI provider…
-
The case for security-embedded architecture with continuous authorization
Continuous Authorization to Operate (cATO) represents a fundamental shift from treating security as an overlay, to embedding security as functional requirements from project inception. Despite its name focusing on authorization, cATO’s primary value lies in establishing security-embedded, shifted-left architectures where security requirements are treated as non-negotiable functional specifications that must be designed, integrated, tested, and…
-
How AI System Behavior Shapes Oversight and Risk Distinguishing Generative and Agentic Systems
Artificial intelligence is being integrated into the processes, platforms, and services that organizations depend on to deliver value. These implementations may involve systems that generate natural language in response to prompts, or systems designed to carry out defined workflows without constant human intervention. In many cases, the terminology used to describe these capabilities is applied…
-
Executing the RMF as an engineering discipline, not a paperwork exercise
The Risk Management Framework is intended to align engineering, operations, and governance with measurable control performance. In practice, some agencies have adapted it into an administrative process focused on documentation rather than active demonstration of protection. The structure of RMF remains unchanged; however, its implementation has shifted toward treating each step as a documentation checkpoint…
-
How AI System Behavior Shapes Oversight and Risk
Learn the key differences between generative and agentic AI, how autonomy shapes oversight and why precision in AI governance reduces operational risk. Artificial intelligence is being integrated into the processes, platforms and services that organizations depend on to deliver value. These implementations may involve systems that generate natural language in response to prompts, or systems…
-
Modernizing RMF for Continuous Evidence Based Security
The fastest way to move RMF away from compliance and into the mission space is to stop treating authorization as a milestone and start treating it as a continuous engineering process. RMF shouldn’t be a side activity, it should be embedded in how a system is built, deployed, and maintained. That starts by tying every…
-
Securing AI: Addressing the OWASP Top 10 for Large Language Model Applications
AI Is Just Software, But It Is Not Just Software Artificial Intelligence (AI) is frequently portrayed as a disruptive force with the potential to revolutionize industries, optimize workflows, and enhance decision-making in ways that were often seen as unattainable. While this perspective highlights AI’s impact, it overlooks a fundamental reality. AI is still software at…
-
Understanding and Addressing Unbounded Consumption in AI Systems
AI systems require substantial computational resources to process data efficiently. These systems generate responses that enable automation by performing tasks typically involving human intervention. They carry out complex operations, enhancing analytical capabilities and improving efficiency across various applications. Additionally, they integrate with other platforms to facilitate seamless data exchange and ensure interoperability within an organization’s…
-
Understanding and Addressing Inaccurate or Misleading Outputs in AI Systems
Inaccurate outputs weaken the trustworthiness of AI systems, particularly large language models (LLMs), by generating responses that appear credible but lack accuracy. When incorrect information is presented as a fact, users may unknowingly rely on flawed outputs that seem correct but ultimately are fabricated. The underlying causes can stem from weaknesses in training data, insufficient…
-
Understanding and Addressing Vector and Embedding Weaknesses in AI Systems
Vectors and embeddings are essential components of modern AI systems, enabling the efficient processing, representation, and retrieval of complex information. These structures enhance the AI system’s ability to interpret and connect data meaningfully, leading to improved relevance and accuracy in generated responses. However, this design can also introduce vulnerabilities that compromise the reliability of the…
-
Understanding and Addressing System Prompt Leakage in AI Systems
System prompts are essential to an AI system. Unlike user-provided prompts, these are embedded instructions that guide how a model processes input and generates output. When system prompts are exposed, they give adversaries important information that can be used to bypass access restrictions, alter decision-making rules, or extract sensitive information. Protecting these prompts is important…
-
Understanding and Addressing Excessive Agency in AI Systems
As AI systems take on more complex roles, their ability to make decisions and perform tasks independently presents significant opportunities to optimize operations and foster innovation. However, this growing autonomy also introduces new challenges, particularly when these systems function outside their intended scope. Without careful management, such overreach can result in unintended consequences that undermine…
-
Understanding and Addressing Improper Output Handling in AI Systems
AI systems assist in decision-making, improve operational efficiency, and automate complex processes. However, if the output is not managed carefully, it can result in significant organizational issues, such as misleading inaccuracies and inadvertent exposure of sensitive information. These risks can undermine the reliability and effectiveness of AI systems, posing potential legal, ethical, and reputational challenges…
-
Understanding and Addressing Data and Model Poisoning in AI Systems
AI systems are heavily dependent on data, and the quality and integrity of that data significantly impact their performance. However, this reliance also creates vulnerabilities. Data and model poisoning attacks occur when the data used to train or update these systems is intentionally manipulated. Such attacks can compromise the accuracy and reliability of AI outputs,…
-
Understanding and Addressing Supply Chain Risks in AI Systems
AI systems typically depend on various components from third-party sources, such as software libraries, pre-trained models, APIs, and hardware. These dependencies can introduce supply chain risks undermining security, reliability, and functionality. Effectively managing these risks is crucial for deploying AI systems that organizations can trust. What Are Supply Chain Risks in AI Systems? Supply chain…
-
Understanding and Addressing Sensitive Information Disclosure in AI Systems
Sensitive information disclosure occurs when AI systems unintentionally share private or confidential information. Organizations that utilize AI to handle sensitive data must understand this risk and take proactive steps to prevent it. This article explores how AI can inadvertently expose confidential information and outlines the measures necessary to prevent such breaches. What Is Sensitive Information…
-
Understanding and Addressing Prompt Injection in AI Systems
Artificial intelligence (AI) is transforming how organizations make decisions. However, it also introduces risks that must be addressed to protect operations and data. One such risk is prompt injection, a vulnerability that can manipulate AI systems to produce harmful or unintended results. What Is Prompt Injection? Prompt injection occurs when a user submits input that…
-
Key Takeaways from CISA/NCSC Guidelines for Secure AI System Development
AI security is a hot topic in today’s cybersecurity landscape due to the increasing integration of AI systems in essential areas like healthcare, finance, transportation, and national security. My company advocates for the responsible design and implementation of AI by taking an ethical, human-on-the-loop approach to AI operations. While offering immense benefits, these systems also…
-
Recommendations for Implementing Secure AI
As I wrote in my previous article Key Takeaways from CISA/NCSC Guidelines for Secure AI System Development, CISA’s “Guidelines for Secure AI System Development” provide a clear path for safely managing AI systems. They highlight the importance of building security into AI systems from the beginning. These guidelines help organizations deal with specific AI threats,…
-
Making a Case for Cybersecurity
In this article we will discuss the complexities of formulating and administering effective cybersecurity programs. I focus on the integration of these programs with business aims, advocating for strong policies, risk management, and defense against contemporary digital dangers. I stress the significance of awareness and training in cybersecurity, along with actionable methods for safeguarding an…
-
A Resilient Cyber Workforce Relies on Public and Private Sector Collaboration
With today’s security gap and current landscape, the necessity of organized, cohesive, and sufficiently staffed cybersecurity teams cannot be emphasized enough. The availability of potential cybersecurity workforce personnel isn’t keeping pace with the demand, and many experts blame it on the lack of interest in cyber education. An annual workforce study conducted by ISC2 to…
-
Information Security Handbook, Second Edition
View Information Security Handbook on Amazon I wrote the second edition of Information Security Handbook as a practical guide to building and managing an information security program that is aligned with the organization it protects. The book focuses on the decisions security professionals actually have to make, including how to align security with business objectives,…
-
Understanding the Pillars of Zero Trust
This week, the White House proposed new standardized cybersecurity requirements for government contractors. This is on the heels of the Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model 2.0 and other recent frameworks that call for the development, implementation and enforcement of U.S. cybersecurity policies. Federal agency roadmaps such as the CISA’s Zero…
-
Integrating Cybersecurity Into the Application Development Lifecycle
Developing resilient code for business applications is critically important to ensure continued mission success by defending against the exploitation of new software vulnerabilities that can be leveraged by attackers to disrupt organizational stability. Ensuring that newly developed code is free from exploitable vulnerabilities contributes to mission resilience by reducing an organization’s overall attack surface. By…
-
The CISO Role Within U.S. Federal Government Contracting Organizations: A Delphi Study
This dissertation examines the role of the Chief Information Security Officer within organizations that support the U.S. federal government. I completed the research as part of my Doctor of Information Technology degree at Capella University in 2020. The research addresses a specific problem within the federal contracting community: organizations are increasingly dependent on digital systems…
-
A Holistic Approach to Application Development and Digital Security for the Enterprise
Developing secure code for business applications is critically important. Without it, companies cannot defend against the exploitation of their software vulnerabilities, leaving businesses open to attackers and the subsequent disruption of organizational stability. By reducing the total attack surface across an enterprise’s digital inventory, an organization is effectively making it more difficult for malicious actors…
-
A new report on the compliance impact of new Federal rules on cybersecurity contractors
The Federal Government is increasing its oversight of federal contractors who gather and store information on its behalf. This is part of a trend in which data collection and storage regulations are constantly being tightened as cyber security becomes an ever-more important factor. The U.S. Federal Government collects an ever-increasing amount of data and as…
-
Vulnerability Management in Today’s Enterprise Environment
Overview Vulnerability management is the process of identifying and mitigating vulnerabilities that exist within an organization and is an integral part of digital systems lifecycle management. Core components include the implementation of technical tools to identify vulnerabilities, triaging discovered vulnerabilities to identify risk, establishing a plan that mitigates vulnerabilities in a timeframe that is commeasure…
-
Is Cybersecurity Automation The Future?
One of the trending topics in information technology is cybersecurity automation. Automating mundane and repeatable tasks that are people-driven allows businesses and individuals to concentrate on more productive problem-solving activities. A focus on these problem-solving activities can foster innovation and lead to a more resilient organization from a cybersecurity standpoint. Automation also increases the complexity of…
-
The Importance of Cyber Hygiene
Cybersecurity took a special place in the 2017 news cycle of as organization after organization fell victim to cyberattacks. It used to be that you would have to break into an organization’s physical building to take their secrets. We now live in a time where your adversary can reach out from great distances, causing great…
-
The Foundations Of Implementing A Zero Trust Architecture
“Zero trust” has gained a lot of attention, and for good reason. Information security architectures have struggled to keep pace with the threat landscape and have not supplied organizations with a successful mechanism to protect itself from external and internal threats. This assertion is well supported by the reports of organizations across industry sectors being…
-
Conducting Organizational Information Security Assessments
The first step that self-help books suggest when a person wants to change is to perform a self- assessment. By honestly looking at yourself – the good, the bad, and the ugly – you can gain the knowledge on what direction you need to travel as you attempt to maximize the program you wish to…
-
Must-Have Skills for CISOs: A CISOs Connect Report
While cybersecurity is dynamic, there are things that are constant. These are the skills that every CISO must have to be successful, whatever the organization and industry, today and in the foreseeable future. In this latest Security Current/ CISOs Connect report, ASRC Federal’s CISO Darren Death combines previous research and his own findings to provide…
-
The Cyber Kill Chain Explained
The cyber kill chain (developed by Lockheed Martin) is an industry-accepted methodology for understanding how an attacker will conduct the activities necessary to cause harm to your organization. An effective understanding of the cyber kill chain will greatly assist the information security professional in establishing strong controls and countermeasures, which will serve to protect their organization’s assets.…
-
Developing a business continuity plan – and sticking to it
It is standard business practice for organizations to have a contingency plan after acknowledging the various threats and risks that it faces. Having a plan in place, however, is not enough. The organization must periodically update the plan, test how well it works, communicate it to stakeholders, and ensure that people have the capability to…
-
Information Security Requirements For U.S. Federal Contractors
The federal government is requiring federal contractors to implement specific guidance in the form of NIST 800-171 in an effort to curb the trend of federal government data being exposed on contractor networks. This disturbing trend has occurred for a few reasons. First, federal contracts often require the use of contractor-owned information systems to process federal information. These…
-
The Attacks of the Future
What might the most damaging attacks of the future look like? The answer to the question may lie somewhere between the known patterns that attackers have established over the years, and signs that we are starting to see today. A look back It started with the sun and the moon. Solar Sunrise was discovered in…
-
Information Security Handbook
View Information Security Handbook on Amazon I wrote Information Security Handbook as a practical guide to building and operating an information security program that fits the organization it is intended to protect. The book starts with the fundamentals of information security, then moves into threat modeling, risk management, security planning, continuous testing and monitoring, incident…
-
Drones, AI, and Security – The Future of Terrorism and Warfare
The purpose behind this article is to pull together some interesting news from the week of 11/13/2017 as it relates to the future use of advanced drone technologies and their ability to cause serious physical harm. In the below article you are presented with a fictional story (video) where advanced drones are used to selectively…