Silvio Pellegrini, CISSP

91% of defense leaders want faster acquisition. But there is a gap: procurement timelines are compressing while deployment timelines aren't. The result? You're buying faster but fielding slower. Warfighters don't need procured technology. They need operational capability. Read how mission integration closes this gap: https://saic.co/mipov3li

43

3 Comments

What is Tier 3 Secret Security Clearance? A Tier 3 security clearance is a background investigation that makes someone eligible for a secret clearance. It's required for positions that are non-critical but sensitive, or that require access to confidential or secret information. https://lnkd.in/gxVHHN85

28

6 Comments

Fail of Fame: ClearanceJobs.com 1. CSP set to “Please Hack Me” default-src * blob: data: 'unsafe-inline' 'unsafe-eval' • This is the CSP equivalent of leaving your front door open with a neon “WELCOME” sign. • Allows any script from anywhere, runs any inline code, and even executes arbitrary strings with eval(). • Impact: Any XSS bug instantly becomes full account compromise, data theft, or drive-by malware. No browser-side safety net at all. 2. CORS Misconfiguration From Hell Access-Control-Allow-Origin: *.clearancejobs.com + Access-Control-Allow-Credentials: true • Wildcard origins aren’t valid with credentials — browsers should ignore it, but backend logic could still misapply it. • If improperly enforced server-side, this could let a malicious subdomain read authenticated API responses. • Impact: Potential data leakage of personal info, resumes, or job activity from logged-in users. 3. Permissions-Policy? Referrer-Policy? COOP/CORP? Nope. • Zero modern isolation headers to reduce the blast radius of a compromise. • Impact: Easy clickjacking, over-sharing of referral data, and no site isolation to contain injected code. 4. Audience Risk Profile Off the Charts • The user base isn’t random shoppers — it’s people with active or pending security clearances, working in defense, intel, and government. • Impact: An XSS or session theft here isn’t just personal inconvenience — it’s an espionage goldmine. 5. CloudFront Popcorn Machine • Sitting behind AWS CloudFront, so an attacker only needs one injection point in any origin server to serve malicious code globally in minutes. • Impact: Massive scale, instant reach, global compromise in one hit. 6. No Defense in Depth • No content isolation, no sandboxing, no enforced HTTPS beyond HSTS, and no selective resource loading. • Impact: Everything depends on backend code being flawless — and backend code is never flawless. Translation: Right now, any competent attacker who finds a small injection or misconfig on ClearanceJobs.com could: • Steal logins and personal data from people with active clearances. • Pivot to spear-phishing campaigns targeting high-value individuals. • Potentially harvest sensitive employment history that could be used for foreign intelligence targeting. Source:

22

11 Comments

🔒 For defense agencies, compliance isn’t optional — it’s mission-critical. This agency modernized with Clovity + Atlassian, achieving: 🔹45% faster compliance audit readiness 🔹Automated approval workflows 🔹Centralized, secure data access 🔹Real-time dashboards for oversight 👉 Discover how mission-critical compliance was achieved without slowing down operations. #Defense #Compliance #DoD #Atlassian #Clovity

8

1 Comment

Ongoing Compliance is one of the largest priorities in a #CMMC assessment. Defense contractors on Reddit are sharing their experiences and p.s. they're not good: "We thought we had everything buttoned up: SSP, POA&M, even evidence mapped to each control. But during a mock audit, the assessor asked who last updated each document and how we track changes over time." Learn more about ongoing compliance with our CMMC Level 2 Lessons✅ 🔗 Link in Comments

15

2 Comments

Don't post your security clearance level on LinkedIn. Why you shouldn’t list exact clearance levels Attracts unwanted attention Adversaries—criminals, insider threats or nation-state actors—scan professional networking sites. Seeing “TS/SCI” or “Polygraph” right in your headline flags you as a high-value target. Reveals OPSEC vulnerabilities Your clearance level hints at the types of programs you might support, or the compartmented projects you could access. Creates a “hunting list” Mass exposure of clearance holders makes it easier for bad actors to compile lists of likely targets. Do this instead... Use generic descriptors ✔️ “U.S. Government cleared candidate” ✔️ “Department of Defense–eligible security clearance” Emphasize skills and experience Highlight domain expertise (e.g. “Cybersecurity Architect with 12 years in network defense”) rather than clearance. Leverage private channels for verification Move any clearance-level discussion into encrypted or authenticated messaging once you’ve confirmed the contact is legitimate.

1,457

107 Comments

We’re excited to share that DMI has been awarded a strategic contract by the U.S. Army 411th Contracting Support Brigade.    DMI will provide full-spectrum S-6 support for the 403rd Army Field Support Brigade (AFSB) and its subordinate Battalions and Logistics Readiness Centers (LRCs) throughout Korea and Japan.   Under this contract, DMI will deliver mission-critical Command, Control, Communications, Computers, and Information Management (C4IM) services that enhance operational readiness and sustainment across the Indo-Pacific theater.   “This is a major win that reinforces our deep commitment to supporting the warfighter,” said Kristian Kindoll, Vice President and General Manager of DMI’s Defense Business Unit. “We’re honored to serve as the S-6 support provider for the 403rd AFSB. Our team is laser-focused on ensuring secure, scalable, and resilient IT services that empower Army units from Camp Humphreys to Camp Carroll and beyond.   Read the full announcement here: https://lnkd.in/dRZ_e_Mj   #DMIDoMore #DefenseIT #MissionReady

112

Navigating the SF-86 form during a security clearance investigation process can be daunting, but do you know the common errors and mistakes to avoid? Use this guide for recommendations to your frequent questions and learn how you can stay clear of a paperwork pitfall. Read on: https://lnkd.in/ejQjP_g8 #DCSA #PersonnelVetting

96

3 Comments

General Dynamics to Bolster Defense at US Army Bases General Dynamics Information Technology (GDIT) has signed a $580-million deal to maintain the security and readiness of US Army bases. This task order encompasses Integrated Base Defense Sustainment Support tasks required to preserve the operational availability of radars, sensors, and cameras that protect installations, their personnel, and infrastructure. These perception systems are critical to inhibit or counter unauthorized access and surveillance, malicious unmanned aerial system activities, and cyberattacks.

41

1 Comment

Zoom for Government has received authorization from the Defense Information Systems Agency (DISA) for Department of Defense (DoD) IL4 NIPRNet and internet-facing communications 👉 https://zm.me/41P0yPq This continues our previous DISA authority and Air Force Authority to Operate but now adds IL4 collaboration directly behind the DoD Boundary Connection Access Point or BCAP. This authorization reflects DISA’s rigorous review and reinforces their trust in Zoom for Government as a secure and robust platform for DoD and its mission partners.

132

4 Comments

Many transitioning service members assume that having a Top Secret clearance automatically qualifies them for any cleared role, but having a Top Secret clearance doesn’t guarantee access to every agency. In theory, all legitimate government clearances are to be accepted and transferable between and among government agencies; this process is called RECIPROCITY, and it is a policy meant to streamline the transfer of security clearances between agencies without requiring a new background investigation. But in reality, clearances don’t always transfer because one agency may not accept another agency’s investigation or adjudication, even if the clearance level matches. For reciprocity to apply: 🐿️ An individual’s new position cannot require a higher clearance than they currently possess. 🐿️ The prior investigation must still be current. 🐿️ The clearance cannot be based on a waiver or interim status. Reciprocity can be denied if the new agency requires a more thorough investigation or if new information comes to light during your background check. And even if your clearance is accepted, you still need to meet the rest of the job requirements like experience, technical skills, education, or certifications. Remember, you are competing with folks who meet 100% of the requirements AND have the RIGHT clearance level ready to go on day one of employment. So applying to jobs in which you only meet 50% of the requirements will not fly with most technical GovCon roles and you will most likely receive a rejection email. That’s why it’s CRITICAL to READ the job description carefully before applying to cleared roles. Good luck to everyone on the hunt for cleared roles. You've got this! Maloney out! ✌ #transitioningmilitary #secretsquirrels #veteranshelpingveterans

43

20 Comments