As our reliance on technology grows, the threat of hackers becomes ever more pressing. Whether they are state-sponsored attackers or amateur "script kiddies," both can inflict significant technical and financial damage. Every day, hundreds of thousands of texts and emails are sent out to lure unsuspecting individuals into clicking malicious links, leading to issues ranging from virus infections to backdoor access and ransomware attacks. These threats not only target personal devices but also pose risks to our broader infrastructure.

The rapid evolution of technology creates opportunities for hackers to steal, extort, and hold victims hostage. If you own a cell phone, tablet, or computer, you're a potential target. While manufacturers invest heavily in securing their devices, hackers dedicate significant time and effort to uncover vulnerabilities, such as zero-day exploits and backdoors. These threats impact us not only on a personal level but also on a critical level that affects our everyday lives. Our public infrastructure—including the electric grid, power generation, wastewater management, water purification, and petroleum processing—underpins essential services. Hospitals and pharmaceutical manufacturing are particularly vulnerable, as they rely heavily on five key infrastructure sectors. Understanding this connection is vital for all of us.

SCADA/ICS environments are becoming highly targeted due to their importance in society and the potential devastation that could occur from a successful attack. Key threats include:

: Attackers can encrypt critical data and demand a ransom, potentially crippling operations.

: Compromising third-party vendors can lead to vulnerabilities in ICS.

: Employees or contractors with malicious intent can cause significant damage.

: State-sponsored actors may target ICS for espionage or sabotage.

Challenges in Implementing Cybersecurity to Industrial Control Systems

: There are still a significant number of ICS’ that rely on outdated technologies and are most likely not designed to handle modern cybersecurity practices. Implementing an update to these systems can be costly and disruptive to the tasks that they perform.

: The integration of IT operations and ICS technology has increased the attack surface. This adaptation introduces new vulnerabilities to the OT environment.

: Organizations must adhere to complex regulations and standards while maintaining and ensuring effective cybersecurity practices.

: There is a knowledge gap and thorough understanding between IT and OT teams in regards to the operations which leads to misaligned security measures and responses.

Published Common Best Practices for Enhancing ICS Cybersecurity

Adopting the proactive cybersecurity methodologies listed below, we can do our best to mitigate cyber-attacks and potential devastating outcomes to our industrial control environments.

: Conduct regular risk assessments to identify vulnerabilities and potential threats. This should include both technical and operational aspects.

: Isolate ICS networks from corporate IT networks to reduce the risk of lateral movement by attackers. Implement strict access controls and firewalls.

: Keep software and firmware up to date to protect against known vulnerabilities. Establish a routine for patch management, particularly for critical systems.

: Develop and regularly update an incident response plan tailored to ICS environments. Conduct drills to ensure all personnel understand their roles in the event of a cyber incident.

: Foster a culture of cybersecurity awareness among all employees. Regular training can help identify phishing attempts and insider threats.

As OT technology continues to advance, the landscape of industrial control systems will continue to expand. The growth of technologies such as artificial intelligence and machine learning can and will enhance threat detection and response capabilities. However, these advancements will also introduce new challenges that every organization must address and implement.

It is a requirement that owners of the OT environment need to continue investing in cybersecurity for their industrial control environments and maintain the safety of our communities. Adopting best practices and staying vigilant against emerging threats, organizations will create a resilient cybersecurity posture that safeguards their operations and assets.

Cybersecurity in the industrial control environment is both complex and essential. As cyber threats grow increasingly sophisticated, organizations must prioritize the protection of their systems. A deep understanding of these challenges, along with the knowledge of procedures and processes needed to implement comprehensive security measures, is crucial for ensuring the reliability and safety of our critical infrastructure in the future.

Cybersecurity Awareness in the ICS Environment

Columbia, MD – October 21, 2024 – Applied Network Solutions (ANS), a leading Veteran-owned government contractor specializing in cybersecurity and networking, is proud to celebrate 25 years of business. Founded by CEO Chris Dunn with a simple mission—to disrupt the status quo by providing top-tier talent to support vital missions—ANS has maintained a steadfast commitment to its employees, its customers, and the mission it serves.

For a quarter of a century, ANS has upheld its founding principles, never undergoing a merger or acquisition, and notably, never laying off any employees due to funding issues. "We're not here to build a company to put butts in seats," said Dunn. "We're building this company for our people and the critical missions we support. Some of our colleagues have been here for over 20 years, and we take great pride in that level of loyalty and commitment."

The secret to ANS's longevity is simple: focus on the people. The company has consistently emphasized that its strength lies in its talent. With some team members who have been with ANS for over two decades, the company prioritizes its employees through celebrations of both personal and professional milestones. ANSers are over 60% veterans and ANS is dedicated to supporting Veterans through its Skillbridge program, partnerships with ESGR, and fundraising efforts for causes like Night to Honor Our Heroes and so much more.

“Our philosophy is pretty simple: we work hard, we play hard, and then we head to the golf course haha. And when we say we put people first, we mean it—we’ve never lost sight of that in 25 years. Without the amazing talented team, we would not have succeeded. It’s simple, no butts in seats, missions that matter, people over profits. We’ve built a company not just to succeed, but to make sure our team succeeds, too. I’m proud of how far we’ve come, and even more excited about where we’re headed.”

ANS brings together some of the brightest minds in networking and cybersecurity. Specializing in both offensive and defensive cybersecurity operations, ANS is committed to delivering technical excellence and exceeding expectations for its customers. The company’s vision for the future is one where talent and customers come to ANS because of its unparalleled reputation for problem-solving and technical expertise and we have been living up to that reputation for a quarter of a century!

As we toast to 25 incredible years, we want to extend our heartfelt thanks to every ANSer—past and present—who has contributed to this wild ride and making ANS what it is today. Your dedication, hard work, and unwavering commitment have shaped ANS into more than just a company—it’s a place where people thrive, laugh, and build something amazing together. Together, we've made the last 25 years extraordinary, and we can't wait to see what the future holds. Whether you're an existing team member or someone looking to join a company that values its people and its mission, there's never been a more exciting time to be a part of ANS.

ANS Celebrates 25 Years in Business!

On December 6, I had the pleasure of sitting down with Vick, one of our valued team members at Applied Network Solutions, who recently had the honor of speaking at the oSTEM conference—an event dedicated to empowering LGBTQ+ individuals in STEM fields. Vick is an outstanding advocate for diversity and inclusivity within our organization and beyond. Their commitment to creating a more inclusive environment for all individuals in STEM is truly commendable and we are proud that Vick is an ANSer!

Without further ado, let's dive into a Q&A session with Vick, where we'll explore their experiences, insights, and reflections from the oSTEM conference and their journey as a member of the LGBTQ+ community in the field of STEM.

Q: How did you discover oSTEM and can you share a bit about your experience speaking at the oSTEM conference? What was the main message or takeaway you aimed to convey during your talk?

A: I discovered oSTEM through a previous coworker of mine who mentioned oSTEM and their mission to me. oSTEM is a 501 non-profit professional society dedicated to LGBTQ+ individuals within the science, technology, engineering, and mathematics community, they help members of the community through mentorship, scholarships, and aiding young professionals in navigating the work force. I was given the opportunity to speak at their conference in November in Anaheim, California. The conference had roughly 1,000 attendees, it was the largest event oSTEM has hosted since being founded about 10 years ago, and I spoke to a group of 40 individuals on salary negotiation and recognizing when to find new opportunities in today’s job market. My overall experience with oSTEM has been incredible. They provided resources and best practices to the keynote speakers (which was really helpful since this was my first time doing one of these!). Overall, this was a really great experience where I was able to give back to the community that has helped me develop into the person I am today.

Q: As an advocate for LGBTQ+ representation in STEM, what are some challenges you've encountered, and how do you navigate or address them within the workplace or the wider community?

A: I would say one of the biggest challenges is that many people assume online interactions mirror all queer community interactions and tend to think that their queer colleagues will be like the online personas they see, or when they read misinformation about the community online, they take it for face value instead of taking time to verify the information came from a credible source. Often, they see some extreme behavior online and assume all in the community fall into that behavior. Which is obviously not true! Also, specifically in the workplace, I have faced some challenges with people sharing their religious or personal beliefs on the LGBTQ+ community, largely stimming from harmful misinformation, and I have to remind them to table the conversation because we are at work. Sometimes it is difficult as I must maintain a certain level of professionalism while addressing these conversations, and many times am addressing my seniors in the work force. When I come to work, I want to do my job like everyone else, not have to stop political debates or justify my existence as a LGBTQ+ person.

Q: Diversity and inclusion are essential for fostering innovation. How do you believe companies in STEM fields can better support and encourage LGBTQ+ individuals in their workforce?

A: Two main things that comes to mind: One, I learned about from listening to people speak at oSTEM events, is that when companies have minority employees, they tend to shove that employee into DEI roles and place a larger workload on said employee, rather than hire someone to be a DEI employee. This often leads to the employee not having the time they need to complete the work they were actually hired for, and for many in the STEM field, not being able to work on projects, studies, and so on so forth, can drastically hold them back on their careers. Companies need to take time and ensure they aren’t shouldering this responsibility onto employees just because they are LGBTQ+, there are many organizations with DEI’s that a company can hire to speak at events or go over company policy to ensure the best possible work environment.

And two, when companies don’t shy away – There has been such a big marketing pull where every company makes their logo a rainbow logo for June and then that is really all they do to “support” their LGBTQ+ community, which is great, but we need more companies focusing on letting queer employees be normal employees and being strong allies and providing resources to help navigate some of the challenges the queer community faces in the workforce and local laws that may target us. It’s great when a coworker feels comfortable enough to ask us questions, but sometimes the questions are extremely personal or based in misinformation and can pull us away from the job we were hired for, if companies have resources so employees can look up terms or questions they might have, it will help LGBTQ+ employees not have to educate their coworkers.

We also often call June the month of “rainbow capitalism” where you see companies paint their products in rainbow colors, while still donating to harmful organizations that actively attack the rights of the LGBTQ+ community. Companies also will hide their support if they have locations based in other countries, which gives the message that while they support us, it comes with terms and conditions. It’s great to support your American employees, but if you have operations in other countries, the LGBTQ+ employees in those countries need to see the support as well.

Q: Were there any particular insights or stories shared during the conference that had a profound impact on you or your perspective?

A: I was shocked to see how many people came up to me after I presented saying that they were taken advantage of during their salary negotiations. So many college graduates and veterans are never taught how to be their own advocate and what resources are out there to help them decide to a fair salary for the position. I was able to provide information on things such as, websites that can be used to research a fair wage, other benefits you can negotiate, how to address these subjects with upper management, and how to scope out a company to ensure it is a good fit beyond what is listed in the job description. One attending after the presentation told me of how she was hired on, and later realized the salary range was 50k over what she had been hired at and she wasn’t sure as to how to address the issue. Being able to give her advice on how to approach it along with factual information she can bring to the table when discussing this with her managers, it showed me even more so just how much college grads and veterans often find out the hard way they weren’t given a fair wage.

Q: How do you envision the future of inclusivity in STEM, particularly regarding LGBTQ+ representation? Are there specific initiatives or changes you hope to see in the coming years?

A: I would say my biggest envision for the future of inclusivity is that when companies hire a new employee, the company doesn’t make it a big deal that the person is queer. Employees in the LGBTQ+ community need to be provided with same resources and treated the same as their colleagues while also making sure there is a safe space for queer employees to raise their voice if they encounter homophobic colleagues. Or if the employee adopts a child, allowing them time for leave much like you would a family who just had a child through birth.

Q: For individuals or organizations looking to be more supportive and inclusive, what advice would you give on creating a more welcoming environment for LGBTQ+ colleagues in STEM fields?

Look to the community – there are numerous LGBTQ+ people who have made their full career off teaching companies how to better support queer employees! My favorite saying is ‘google is free’ – there are so many resources out there if you just get curious and truly want to make a change at your company for creating a better work environment for your employees all around. Things such as hiring a DEI, or a speaker to educate employees on their options and local resources.

Q: In your opinion, what role does allyship play in creating an inclusive workplace culture, and how can allies better support the LGBTQ+ community in STEM?

A: Allies can better support by listening – often us in the LGBTQ+ will have allies that feel they know best because they read an article online or heard something in the news. Being a good ally means giving us space to speak for ourselves, and also advocating for what we say. No one will ever completely agree with another person on something, but if a coworker is saying something problematic when another employee isn’t around, addressing that is also being an ally. The conversations are often uncomfortable for all involved, but we can’t tolerate our coworkers spreading harmful rhetoric. I’ve found telling coworkers to keep some conversations to their personal lives has helped in these situations, but I’m not around all the time. Allies have to stand up for their LGBTQ+ coworkers when they’re not around as well.

Q: Could you share some resources or initiatives that have been particularly beneficial for you or others in the LGBTQ+ community pursuing careers in STEM?

A: Honestly, oSTEM has been an amazing resource! Outside of that, local communities will have their own LGBQT+ professional chapters or colleges. Local to Denver, we have a LGBTQ+ professionals organization, we have groups from outdoor events to charity events to help those in our community. Sometimes the best resource is those down the street from you.

Q: How can we encourage more LGBTQ+ individuals to pursue careers in STEM fields, especially considering the importance of diverse perspectives in innovation and problem-solving?

A: A lot of LGBTQ+ individuals suffer from imposter syndrome as we often aren’t raised in welcoming communities, and they will hold the belief they are not qualified for higher end positions. Companies providing spaces for employees to address these concerns, while giving reassurance and positive feedback, helps employees feel valued and that they are performing as needed for that position.

Q: Lastly, what personal or professional aspirations do you have in continuing to advocate for diversity and inclusion within the realm of STEM?

A: On a personal note – there is a quote I live by from John Adams : “I must study politics and war... so that my sons can study mathematics and philosophy, navigation, commerce and agriculture so that their children can study painting, poetry and music.” I have always taken this quote to heart as I attend these events and assist the younger LGBTQ+ community. I continue to be a voice in the community so that future generations will not face the same challenges of discrimination those of my generation have, for them to feel welcome in their everyday lives as well as their work life.

On a professional note, there is always room for improvement – and again, getting my voice out in the community is something I want to continue to do, especially in STEM – specifically in government contracting. When most people think of government contracting, they picture a veteran male. So, I want to show that queer people have a seat at the table and that there are inclusive companies out there in every industry! The first job I had outside of the military, I had no one I directly worked with that was also apart of the LGBTQ+ community. I will never forget the first time I switched contacts and suddenly had LGBTQ+ coworkers I interacted with every day, it made me feel safe and welcomed there. Even if those of my community can’t hear my voice, I want them to be able to seen in this position, this work force, and feel there is a place for them.

In conclusion, Vick's insights and experiences shared in this Q&A session shed light on the importance of creating an inclusive environment for LGBTQ+ individuals in STEM fields. Their journey as an advocate for diversity and inclusion within Applied Network Solutions and the broader community highlights the challenges faced and the strides yet to be made.

From Vick's impactful presentation at the oSTEM conference, emphasizing the significance of fair salary negotiations and providing resources for individuals navigating their careers, to addressing workplace challenges such as misconceptions, misinformation, and the need for genuine support from companies beyond symbolic gestures, their perspectives offer a roadmap for progress. We are proud to have Vick as part of team ANS.

Q&A w/ Vick Grubbs – Guest Speaker at oSTEM

            In a world where corporate responsibility is under constant scrutiny, Applied Network Solutions (ANS) emerges as a shining example of unwavering dedication to its employees and the nation we serve. On September 20, 2023, ANS reaffirmed its commitment to those who selflessly serve in the National Guard and Reserve by signing a Statement of Support with the Employer Support of the Guard and Reserve (ESGR). ANS Statement of Support reiterates ANS's commitment to its employees who serve in the National Guard and Reserve and emphasizes our dedication to fostering a supportive and inclusive workplace culture. In this blog post, we dive into the significance of this commitment and how it reflects ANS's values and vision because this decision isn't merely symbolic; it's a resounding declaration of who ANS is at its core.

ANS Commitment to the ESGR – Quote from Dunn and ANS Stats

            On September 20th, Applied Network Solutions (ANS) marked a significant occasion as we proudly signed the ESGR Statement of Support at its Headquarters in Columbia, MD (Signed by CEO, Chris Dunn), and at its San Antonio, TX office (Signed by TX Director, Charlie Brandt). The signing took place at 4:00 PM Eastern and numerous ANS employees and ESGR volunteers participated. "Putting our signature on the ESGR statement of support was more than just a moment; it was a heartfelt acknowledgment of the invaluable contributions made by our Reserves and National Guard. We take immense pride in standing by those who selflessly serve our nation, and through this commitment, we reaffirm our unwavering support for their dedication and sacrifice." - Chris Dunn, Applied Network Solutions. The event showcased ANS's dedication to supporting its employees in their military endeavors while maintaining an environment conducive to professional growth. ANS takes pride in being an employer of choice for the military community, and our statistics speak volumes: composed of over 50% Veteran Employees with numerous ANSers in the Reserves, we are not just a company but a team that honors and supports those who serve.

            Employer Support of the Guard and Reserve is an initiative within the U.S. Department of Defense that promotes understanding and cooperation between Reserve Component Service members and their civilian employers. Its mission is to ensure that employers across the nation support the service of their employees in the National Guard and Reserve, making it easier for these dedicated individuals to balance their military commitments with their civilian careers. Additional information about ESGR may be found on website 

            Applied Network Solutions' decision to sign a Statement of Support with ESGR is not just a corporate formality; it is a meaningful declaration of the company's values and priorities. By actively supporting employees who serve in the National Guard and Reserve, ANS is not only fostering an inclusive and supportive workplace but also contributing to the well-being of those who safeguard our nation. This move stands as a testament to ANS's commitment to its employees and to the ideals of patriotism and corporate responsibility. In a world where actions speak louder than words, ANS has spoken volumes with this bold step, setting an example for businesses everywhere to follow.

ANS would like to thank the volunteers of ESGR for their support!

ANS Strengthens Its Commitment to the Military: Adding a New Layer of Support through ESGR Partnership

In light of Presidents’ Day, our CEO shared his admiration for his favorite President, Ronald Reagan in a recent Q&A session. We talked about the former president's values, leadership style, and the lessons we can still learn from him today. As he was known for and truly was the “Great Communicator.”

Q: Who is your favorite President and why?

 Ronald Reagan – and as to why, well there are a few main points that come to mind. Mostly, his love for our country. He was a true “America first” President and was one of the first Presidents who went across party lines and brought America together. He was a Hollywood stud who turned Politician to bring the country together. We were in turmoil, inflation was crazy high along with unemployment and interest rates, civil rights and Nixon (e.g., Watergate) and because of his ability to be a people’s person and to turn the focus internal and on America he was able to unify our country in a truly remarkable way.

Q: What is your favorite quote from President Reagan?

I actually served in the U.S. Army under Reagan and found inspiration when he directly addressed what we knew then as the Soviet Union in his speech he gave in West Berlin in 1987. Reagan's statement was a direct challenge to Soviet leader Mikhail Gorbachev to dismantle the wall and to bring an end to the division of Germany and Europe.

Q: How did he inspire you and your career path?

“America first” – Love America and treat everyone the same. Anyone who knows me knows that I am not a “CEO first” mindset – I am an Engineer and at ANS our org chart is upside down, where I report to everyone. Reagan once said “

The greatest leader is not necessarily the one who does the greatest things. He is the one who gets the people to do the greatest things

.”We are a team; we win together, and we lose together.I believe that by looking inward and treating your company (or for Reagan, his country) as the same and equal we can achieve great things together.

Q: What can we still learn from President Reagan today?

Honestly, how great America is! But on a different level, there are a lot of lessons we can learn decades after his presidency.

Leadership being a big one. Reagan was a charismatic and effective leader who was able to communicate his vision and inspire others to work toward a common goal. He emphasized a clear and consistent message, a willingness to listen to others, and a positive and optimistic outlook.

Although Reagan was a conservative Republican, he was also known for his ability to work with members of the opposite party and find common ground on important issues. Today, in a time of heightened political polarization, we can still learn from Reagan's legacy for bipartisanship and his willingness to put country over party.

While I could continue on and on as to what we could still learn from Reagan today, I will end with his view of the power of ideas. Reagan was a strong advocate for the power of ideas and the importance of ideological debate. He believed that by engaging in robust and respectful discussions, we could find solutions to even the most difficult problems. One of our core values at ANS is continued excellence;  accept the challenge, chose to be a leader.  We want to solve problems, and work together, with respect.

Q: Any closing remarks about why President Reagan is your favorite President?

Never let things you can’t do stop you from doing what you can!

Having worked alongside President Reagan in support of The White House Communications Agency (WHCA), during his time in the Army, Chris Dunn was able to provide a unique perspective. One that America grew to love President Reagan for, but Dunn got to experience firsthand. ANS hopes you have a great Presidents’ Day and encourages you to take time to reflect on your favorite President and how their leadership can inspire you!

Q&A President’s Day 2023

Applied Network Solutions, Inc. (ANS) strives to stay on the leading edge of technology with regards to network architectures, network security and enterprise infrastructure security. One of the major shifts over the last decade, and increasing over the last five years, has been a shift to cloud computing.

Prior to cloud computing, the task of securing an enterprise server infrastructure was easy to define when every server was a physical host. It essentially came down to three architectural components: 1) secure the server operating system, 2) apply secure practices to application development and deployment, and 3) secure the network around the server. The move to virtualization did little to change this, only adding a fourth component: secure the hypervisor. The introduction of containers made things a little more complicated, but early implementations treated containers as special instances of an application on a server. Most of our traditional security practices are based on this simple architecture. This includes vulnerability scanners that externally look at the network interface of a server and internally the operating system configuration and software.

The move to cloud computing has changed this. The clean boundaries of application, server, hypervisor and network may not exist in a cloud deployment. A simple deployment of a virtual machine requires transferring responsibility to the cloud provider for security of the physical infrastructure, the hypervisor, the storage, and the network boundary. The Enterprise retains control over the server operating system, the applications and defining the security controls for the network boundary. Still, this architecture is not that different from a traditional architecture. The same vulnerability scanners can be used to monitor the system and software.

The introduction of cloud-based containers (e.g., Docker with Kubernetes) and serverless computing renders these traditional methods obsolete.

Network scanners are unable to perform port and protocol scans of containers and serverless computing. Likewise, traditional firewalls are unable to define a static set of rules to control communication between contains.

Containers create an overlay network for their communication that is inaccessible to a scanner. Further complicating the problem is when managed by an orchestrator, such as Kubernetes, containers can be ephemeral coming and going as needed to support the workload.

Serverless computing has no associated IP addresses to scan. They are nothing more than application modules utilizing network API calls to other resources. They are ephemeral and are only run when invoked and disappear when the module function returns and exits.

Software vulnerability scanners have a similar problem. There is no host on which to run the scanners.

The problem with network scanners does not have a solution. There is no static target to scan with regards to internal communications. The best they can do is to treat containers and serverless computing the same as internal applications on a server and scan the external facing services provided by the system.

Traditional firewalls will need to take a similar external facing approach. A non-traditional firewall architecture can go deeper into the environment by extending the concepts of a Software Defined Perimeter to containers. A Software Defined Perimeter focuses on the application communications, both internally and externally. A controller is used to adapt to the changing environment as needed.

The Software Defined Perimeter concept was initially designed for managing communications between virtual machines. Large applications, such as a web site, can have different VMs performing different functions. A simple example is the front-end servers providing the web page, and back-end servers performing data access, billing, and other functions. A Software Defined Perimeter protects the communications between these different components and limits the impact should one of them be compromised. It can also provide protection to the external access to the system. A key aspect of this concept is it can adapt as needed as compute resources are added and removed and based on other aspects such as the user requesting services.

Extending the Software Defined Perimeter for containers can leverage the same concept but cannot be implemented by simply putting a smart firewall on the network. A solution such as provided by the Istio project (https://istio.io/) is an example of a firewall with can implement a Software Defined Perimeter for containers.

Network Security for Serverless Computing

Network security for serverless computing requires a different approach. There are no discrete network communications between serverless functions. This means there is nothing to scan, and no IP communications to protect.

Security in this environment is dependent on the definition and application of policies and roles. Performing the equivalent of a network scan would require evaluating these policies to determine if they are compliant with the intended allowed communications. A resource would be the equivalent of a host, and the allowed functions would be the equivalent of ports.

Performing software vulnerability scanning for containers and serverless computing also requires a different approach. Neither of these have a host on which to run the scans of the operationally deployed software. Instead, a proxy approach must be used.

Solving this problem requires recognizing the software is first developed on a traditional host. Software in the development environment can be scanned to ensure it is not using any packages with known vulnerabilities. Scans can also be used to verify the code is following acceptable security coding practices. Ensuring the deployed software matches what was scanned requires developing a method to compare the scanned software to the deployed software.

A Software Bill of Materials should be maintained for any packages incorporated into the containers or layered onto the serverless computing functions. This will make it easier to identify software using packages that have been newly identified as containing vulnerabilities.

Moving to a cloud environment utilizing containers and serverless computing requires changing how we view security and our techniques for performing vulnerability scans and assessments. Traditional security scanners and firewalls cannot operate in an environment where the entity running the software is ephemeral and have no define host on which they run. Containers managed by an orchestrator (e.g., Kubernetes) can come into and out of existence as needed. Serverless computing is nothing more than application code that runs only when invoked and leverages network API calls to other resources in the cloud environment. Neither have a host on which to run software scanners.

Protecting these environments requires the adoption of new approaches for performing security scans and implementing firewall protections.

Cloud Computing

At ANS we provide world-class network engineering and cybersecurity services that help secure the most critical government networks. Those network owners count on our expertise with the rapidly changing strategic and technological elements of cybersecurity to enable them to make risk informed security decisions. It is critical that we anticipate customer needs as they roll out new network configurations and cybersecurity capabilities. Zero Trust (ZT) is an example of a concept we must understand and prepare to support for our customers. Planned deployment of ZT capabilities throughout the government and private sectors has the potential to fundamentally change the nature of the networks we help protect, and will require us to develop new skills, tools, and methods to support our customers through this period of change.

 was issued that mandates the federal government to “advance toward Zero Trust Architecture (ZTA).” Subsequent 2022 OMB memorandums M-22-09 

Administration Cybersecurity Priorities for the FY 2024 Budget

 made it clear that ZT is a major focus for federal government network defense. In 2021 NSA, DoD, NIST, CISA, and even our allies at the UK NCSC all published ZT guidance in the form of architectures, frameworks, and maturity models to help speed understanding and adoption of ZT security capabilities. Similar work is occurring simultaneously across private sector organizations, with new white papers dropping almost daily from sources like Gartner, Forrester, and many other researchers. The vendor community is aggressively moving out to provide solutions for the evolution of public and private networks to ZTA, producing new products and updating existing products to provide the necessary capabilities.

Throughout 2022, work on ZT has accelerated in both public and private sectors with a focus on planning for widespread adoption, research and training, standards development, demonstrating solutions in testbeds using available commercial technology, and opportunities to add ZT concepts to widely adopted cyber security frameworks. Let’s discuss a few of those efforts.

In early 2021, the DoD Chief Information Officer, John Sherman, announced plans to create a new portfolio office to manage the DoD Zero Trust Architecture Program. The effort was officially launched in January 2022, and in only a few short months produced a strategic plan that will enable DoD to achieve a target level of ZT capabilities across the DoD Information Enterprise.

This strategic plan, intended for release in October 2022, defines 45 ZT Capabilities, 42 of which are targeted for deployment by 2027. The document further details that these capabilities are comprised of 152 Activities, 90 of which map to the 45 capabilities planned for 2027. It also suggests three potential synergistic courses of action for deployment ranging from enhancing the existing DoD enterprise to more “greenfield” options for commercial and private cloud-based network architectures.

Additionally, the portfolio office completed a 2.0 update to the 

 originally published in 2021, to be released as an aid in implementing the strategic plan by serving as an authoritative guide for DoD ZTA and solutions. They also plan to publish a 

 containing timelines to implement ZTA across most DoD enterprise systems beginning in 2023 and depicting ZT capability advancement across all seven DoD defined pillars, capturing predecessor/successor capabilities.

NIST NCCoE Zero Trust Architecture Implementations (NIST SP 1800-35)

In August 2020, the National Institute of Standards and Technology (NIST) published Special Publication (SP) 800-207 

As the first US Government publication addressing the concept of ZT in significant detail, it has influenced all later ZT publications, including NSA’s 

. In SP 800-207, NIST introduced all the basic tenants of Zero Trust, defined the logical components of a ZTA, and discussed many of the other concerns related to migrating to a ZTA.

The National Cybersecurity Center of Excellence (NCCoE), a part of NIST, has begun to build a series of exemplar ZTA solutions in their Zero Trust testbed in collaboration with a group of 32 ZTA technology providers. The project goal is to use commercially available technology to build interoperable, open standards based ZTA implementations that align to the concepts and principles in SP 800-207. Multiple scenarios are planned in diverse enterprise testbeds, leveraging distinct sets of vendor security products as integrated ZTA solutions. This effort is an iterative process with results shared through updates to NIST SP 1800-35 Volumes A – D after each iteration, as appropriate.

The preliminary drafts of all volumes of SP 1800-35 documenting the details and results of the first functional demonstration are available for review on the NIST ZT 

. Sufficient details are provided to duplicate both the testbed environments and the functional demonstrations if desired.

The results of the first experiment (described in the publication as the “crawl phase”) were predictable. All the solutions used for this demonstration integrated well within their own vendor ecosystems and provided the desired capabilities. However, many of the vendors used do not integrate outside those vendor specific ecosystems out-of-the-box (NIST uses only integrations provided by solution vendors rather than custom integrations for this project.) This prevented implementation of all the desired enterprise ZT capabilities. The solution set chosen for this demonstration also lacked a Comply-to-Connect capability, so there was no way to prevent an endpoint from initially joining the network based on its authentication status by performing authentication and reauthentication of resources that host endpoints.

This NCCoE project is serving a critical role in providing examples of ZTA commercial solution integration, identifying gaps in the available technology, and highlighting problems with integration across vendor ecosystems. Hopefully new partnerships will emerge from this effort to address those technology gaps and the participating capability providers find ways to better integrate that provide holistic enterprise ZT solutions.

Originally developed to meet the requirements of the Cybersecurity Enhancement Act of 2014, the NIST 

Framework for Improving Critical Infrastructure Cybersecurity

 (CSF) has since become a best practice for cybersecurity applied by governments and businesses worldwide. NIST has begun updating this ubiquitous cybersecurity framework to keep pace with the evolving cybersecurity landscape through a series of 

, the first held on 18 AUG 22. The secret to encouraging international adoption of the CSF v1 was strong stakeholder engagement. NIST plans to continue their history of transparent stakeholder engagement through a series of collaborative workshops, interactive development of multiple drafts, and use of dedicated Slack channels to produce the updated version.

This revision of the CSF is an opportunity to synchronize ZT concepts with the CSF. A key theme to emerge from the responses to the Request for Information (RFI) that preceded the first workshop was the desire to “Align the CSF with existing efforts by NIST and others” and “Ensure the CSF remains technology neutral yet can be applied to specific and emerging topics such as cloud, hybrid work, and zero trust.” ZT implementations would greatly benefit from the standard, vendor agnostic taxonomy that could be provided in the new version of CSF, enabling better mapping across any number of other cybersecurity frameworks in use today.

In March of this year, the Cloud Security Alliance (CSA) announced the launch of the 

 in partnership with CrowdStrike, Okta, and Zscalar. The new center’s purpose is to explain ZT as a strategy in a vendor-agnostic setting, frame it with a set of guiding principles, and help provide context around the myriad of related solutions. To achieve these goals, they plan to:

Lead the development of tools and resources to guide ZT implementation

Build and evangelize authoritative ZT best practices and tools

Create research, training, professional credentialing and provide an online center for additional curated ZT resources

Provide courses in ZT architecture and strategy, a CloudBytes webinar series, several research whitepapers, an annual ZT Summit to be initiated in Q4 2022, and a new professional credential, the Certificate of Zero Trust Knowledge (CZTK).

In August, the CSA also launched a ZT Working Group focused on collaboratively developing Zero Trust standards to achieve consistency for cloud, hybrid, and mobile endpoint environments. This working group plans to perform research and produce deliverables such as specifications, architectural guidance, technical documents, thought leadership articles, position papers, and implementation guidance. This work will focus on nine workstreams:

Zero Trust as a Philosophy & Guiding Principles

Zero Trust Organizational Strategy & Governance

Automation, Orchestration, Visibility & Analytics

Zero Trust Architecture, Implementation, and Maturity Model

The CSA has a long history of delivering on their promises for developing new architectures, specifications, and standards for cloud security. There is little doubt that they will be successful in developing new ZT focused security specifications, standards, and related architectures.

The level of interest in Zero Trust across the public and private sectors continues to grow and the level of effort applied to moving ZT concepts closer to widespread adoption is encouraging. However, most of the efforts discussed are moving forward without coordination or, in some cases, even knowledge of the other efforts. Zero Trust activities must be coordinated such that they share a common taxonomy, map to a common set of security controls where appropriate, and most important avoid contradictory guidance that will confuse and delay widespread adoption.

While it would be convenient to just buy Zero Trust in a box, no single vendor today provides all the solutions necessary to deploy a holistic enterprise ZTA solution. But many of them already have products that meet some of the requirements of ZTA, so progress towards implementation can start now. A common goal of all these efforts is to enable vendor agnostic implementations. To avoid having to develop “glue code” to integrate products from multiple vendor ecosystems, we need ZTA enabling data standards, command and control standards, interface standards, universal playbooks for automation, and maybe even dedicated message fabrics to make that vision a reality. Another option would be for coalitions of vendors to work together to provide integrated solutions in answer to government contracts, like they did for the DHS Continuous Diagnostics and Mitigation (CDM) program.

Achieving these goals requires true public/private coordination and partnership to ensure that we do it right the first time. All the efforts described in this article need to align and work together to ensure standardization of core concepts. And the standards bodies need to complete their work on ZT standards quickly to enable the ZT community to overcome the challenges of integration and deployment of solutions. Collaboration is key to success.

ANS is tracking these efforts, and in some cases participating in the working groups. All of us working in cybersecurity should ensure that network owners are aware of the ZT work that is underway and help them prepare for success. Proactively consider ways ZTA will force us to evolve the tools and techniques we use today. Take every opportunity to engage the ZT community to encourage synchronization of effort. We can all play a role in making ZTA a success. Let’s help make it happen together.

ZT Architecture: Coming Soon!

One of the hottest topics in cybersecurity today is Zero Trust. Just in the past 20 months, DoD[i] and NIST[ii] published Zero Trust Architectures, CISA published a Zero Trust Maturity Model[iii], an Executive Order[iv] and OMB Memorandum[v] levying requirements on government organizations to implement Zero Trust were issued, and GSA released a Zero Trust Architecture Buyer’s Guide[vi]. Not to mention all the vendors advertising Zero Trust solutions, Gartner and Forrester publications, and the other 3,660,000,000 results from a Google search on the term “Zero Trust.” Likewise, a search on the term "How to Implement Zero Trust" yielded 80,900,000 results. It’s safe to say there is a lot of interest in Zero Trust.

But what is Zero Trust? According to Gartner[vii], Zero Trust network security “starts with a default deny posture of [trusting nothing]. Access is granted based on the identity of the humans and their devices — plus other attributes and context, such as time/date, geolocation, device posture, etc. — and adaptively offers the appropriate trust required at the time.” This is a significant paradigm shift from traditional, "trust, then verify” perimeter-based network security that seeks to keep malicious actors out, while assuming that anyone who is already inside the network can be trusted. The Zero Trust security model eliminates the idea of a trusted network, assuming instead that threats exist both inside and outside a network, so no one human or thing can be trusted implicitly. Under this model’s principle of "verify, then trust," permissions are only granted to user accounts, devices, applications, or services once properly validated, and moreover trust must be continually revalidated to maintain access.

With all the buzz, you’d think Zero Trust is a brand-new silver bullet for all our cybersecurity concerns. But if you’ve worked in cybersecurity for a while, you’ll find much of Zero Trust to be hauntingly familiar. Let’s explore that further:

Since it seems that each publication addressing Zero Trust has a different take on the concept, for simplicity let’s just look at one of the Zero Trust frameworks, the DHS CISA Zero Trust Maturity Model.

 organizes capabilities required to achieve Zero Trust into five categories (referred to as pillars): Identity, Device, Network/Environment, Application Workload, and Data. The capabilities listed in each pillar are then divided into three maturity levels: Traditional, Advanced, and Optimal. It’s here that a sense of déjà vu begins to set in when looking at the security functions called out for each block of the Maturity Model.

As we begin to examine the CISA model, we see Multifactor Authentication and Federated Identity required under the Identity pillar. Nothing new here conceptually. The original patent[viii] for the SecurID token was filed in 1993, Chip and Pin for credit cards was introduced in France in 1984[ix], and Paypal began offering a token for multifactor authentication around 2006[x]. So multifactor authentication has been available to enhance identity security for decades. Standards for Federated Identity Management (Single Sign-On) such as OpenID have been around since 2005[xi], and many commercial solution providers have broad user bases today. Again, nothing new.

Under the Device pillar, Device Compliance Enforcement and Data access management based on initial device posture are specifically called out. Requirements for automated asset management, vulnerability scanning, and patching are also levied in the detailed descriptions of this pillar. Again, not really anything new. In the SANS Consensus Audit Guidelines[xii] (the precursor to the SANS Top 20 Security Controls) dated 02 Mar 2009, the first control requires an inventory of all devices on the network and the third requires secure configurations for all network devices. NIST 800-53[xiii] published in February 2005 addressed requirements for configuration management. For over a decade, we've had solutions associated with Network Access Control and VPNs that install a client on the user’s computer and assess device security status and compliance before admitting the device onto the network. More recent methods add other sources of data, such as endpoint security scanning, and network vulnerability scans to facilitate that determination. This is the basis of the DoD comply-to-connect strategy and associated implementation framework[xiv] developed over the past decade. Everything in the Traditional and Advanced blocks of this pillar are well-known security requirements with existing solutions.

In the Network/Environment pillar, we see macro-segmentation, traffic encryption, internal micro-segmentations using micro-perimeter controls, as well as basic network traffic analytics. Traditional firewall and VLAN technology to enable macro-segmentation have been available since the late 90s[xv]. Information Flow Enforcement controls to enforce segmentation was first added to NIST 800-53 in Rev. 1 published in 2006. Next Generation firewalls coupled with Active Directory (or other user-to-IP tie-in) have been capable of enabling network micro-segmentation for over a decade.

The concept of Micro-perimeters is a more recent development moving the firewall to the application. For comparison, network micro-segmentation might sit at the front of a data center and can control the IP addresses, and for web pages, the URL accessible by a user. The micro-perimeter sits with the application and can control access with finer granularity beyond just the URL, such as the type of queries allowed. While the term micro-perimeter is new, the ability to provide this level of data access control at the application level is not. The Multiplexed Information and Computing Services (Multics)xvi operating system designed in the late 1960s, and evolved through the 1980s, provided an application-based data protection capability similar to a micro-perimeter. The operating system could prevent direct user access to data thus enabling the application as the enforcement control point for data access. The concepts are the same, differing only in the method of access to the application.

Other Network/Environment pillar capabilities have also been around. We have had the capability to do basic traffic analysis for 20+ years. And strong encryption for data-at-rest and data-in-motion has been recommended and commercially available for decades.

The Application Workload pillar for the Advanced Maturity level requires centralized authentication and authorization for access to applications and integration of threat protections into application workflows. Standards and solutions to meet these requirements have been available for almost forty years, dating back to when MIT developed Kerberos[xvi] in the 1980s. Requirements for application security date back to the early publications of both the Sans Top 20 Security Controls and NIST 800-53. The migration to cloud services has accelerated the use of centralized authentication services.

The final pillar, Data, requires application of least privilege data access, and encryption of data at rest. The concept of Least Privilege dates back to 1983 when the National Computer Security Center (NCSC) Trusted Computer System Evaluation Criteria (TCSEC, aka. Orange Book)[xvii] was initially released. The original 2009 SANS critical controls included “Controlled Access Based on Need to Know,” and the 2005 release of NIST 800-53 v1 included the Least Privilege security control. It is not until the third revision of 800-53 in 2010 that we see a control specifically addressing Protection of Information at Rest recommending encryption, but that was added twelve years ago. Again, all well-known cybersecurity principles.

The question is then “Is Zero Trust just old wine in a new bottle?” or does it bring something new to the fight? Zero Trust is at least shining a new spotlight on required security controls that haven’t been universally applied despite having been known and recommended for many years. If so many of the tenets of Zero Trust have been recommended by security practitioners for decades, why aren’t they already in widespread use? The answer lies in the fact that security is the enemy of ease of use. Network users don’t want to be burdened with carrying tokens for multifactor authentication, strong passwords that are hard to remember, having to ask for access to data that they didn’t need to do their job until just now, networks slowed by the need to encrypt and decrypt data, and all the other “burdens” of strong cybersecurity. Security is also hard, often requiring restructuring of network architecture and additional capital investment. Security is often seen as an unnecessary cost by senior executives, at least until after they experience a ransomware attack or major security breech. Mandatory requirements for Zero Trust may be just the incentive needed to get network owners to finally implement all those well-known security controls we’ve recommended for decades.

Zero Trust also brings with it several newer concepts. The core tenet of Zero Trust is to assume that the network has already been compromised, and malicious actors are inside the network perimeter. This idea encourages stronger identity management and access controls and shifts the defensive focus from boundary defense to role-based and attribute-based access, network segmentation, data segmentation, and treats each application as a boundary. This leads to a key new concept: The user logs into applications, not the network, and data is accessed through the application based on the user’s need to know, and right to know. The paradigm shifts from blanket trust to transactional trust.

The truly innovative elements of Zero Trust are found in the requirements for the Optimal level of the CISA Zero Trust Maturity Model. Continuous validation isn't that hard to achieve. Most centralized security authentication/authorization systems issue a token that has a lifetime forcing continuous validation. When the token expires, re-authentication/authorization is required. In Contrast, real time analysis, continuous monitoring, machine learning, encryption of all data at rest and in motion, and other requirements are beyond the scope of most current enterprises. Virtualization, cloud services, artificial intelligence, machine learning and automation capabilities are required to achieve these goals. Technology is truly still evolving as new approaches and techniques improve how this can be done by machines, because in most places there aren't enough human resources to manage and analyze the data flow, much less do it in real-time. For most network owners, this will require significant investment and rebuild of their networks to add these capabilities. These investments and changes are unlikely to happen overnight. Network owners can still implement those legacy elements of Zero Trust that are well understood and for which many commercial solutions are available in the near term.

The bottom line is that Zero Trust can serve as a forcing function for the implementation of good security practices that have been recommended by cybersecurity practitioners for many years, while encouraging adoption of even stronger controls enabled by newer technologies. Adoption of Zero Trust principles will help minimize the blast radius of data breaches to single user sessions rather than the entire enterprise. And the increased automation and centralized control required for an optimal implementation of Zero Trust will reduce the burden on administrators implementing required security controls, making them more dynamic and transparent to users. Finally, remember Zero Trust is a journey not a destination, with each step taken providing more protection to organizational data, and well worth the trip.


[i] Joint Defense Information Systems Agency (DISA) and National Security Agency (NSA), Department of Defense (DOD) Zero Trust Reference Architecture (2021).

[ii] Rose, S., Borchett, O., Mitchell, S., & Connelly, S., NIST Special Publication 800-207 Zero Trust Architecture (2020).

[iii] CISA Cybersecurity Division, Zero Trust Maturity Model (2021).

[iv] Exec. Order No. 14028, 86 Fed. Reg. 93 (May 12, 2021).

[v] Office of Management and Budget, Memorandum M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles (2022).

[vi] GSA, Zero Trust Architecture Buyer's Guide (2021).

[vii] McQuaid, A., MacDonald, N., Watts, J., & Handa, S. (2022). (tech.). Market Guide for Zero Trust Network Access. Gartner

[viii] Weiss, K. P. (1996, January 16). Enhanced security for a secure token code.

[ix] Roos, D. (2014, May 16). How chip and PIN credit cards work. HowStuffWorks. Retrieved May 18, 2022, from https://money.howstuffworks.com/personal-finance/debt-management/chip-and-pin-credit-cards.htm

[x] Gibson, S. (2007, August 2). Security now! Transcript of Episode #103. Retrieved May 18, 2022, from https://www.grc.com/sn/sn-103.htm

[xi] Fitzpatrick, B. (2005, May 16). Distributed identity: Yadis. LiveJournal. Retrieved May 18, 2022, from http://community.livejournal.com/lj_dev/683939.html

[xii] Gilligan, J. (2009, February 27). Consensus Audit Guidelines - Draft 1.0. SANS.org. Retrieved May 18, 2022, from http://www.sans.org/cag/guidelines.php

[xiii] NIST, Recommended security controls for Federal Information Systems and organizations (2005). Gaithersburg, MD; U.S. Dept. of Commerce, National Institute of Standards and Technology.

[xiv] Defense Information Systems Agency. Fact Sheets. (n.d.). Retrieved May 23, 2022, from https://www.disa.mil/about/fact-sheets

[xv] "IEEE Standards for Local and Metropolitan Area Networks: Virtual Bridged Local Area Networks," in IEEE Std 802.1Q-1998 , vol., no., pp.1-214, 8 March 1999, doi: 10.1109/IEEESTD.1999.89204.

[xvi] S. P. Miller, B. C. Neuman, J. I. Schiller, and J. H. Saltzer, Section E.2.1. Kerberos Authentication and Authorization System, M.I.T. Project Athena, Cambridge, Massachusetts (December 21, 1987).

[xvii] National Computer Security Center, DoD 5200.28-STD Department of Defense Trusted Computer System Evaluation Criteria (1985).

Zero Trust: Same Old Controls, or Something New and Shiny?

…But my dad, my sister, and my brother-in-law did, and I genuinely respect all those who have. With Applied Network Solutions (ANS), I am excited to be part of a company that shares my passion to honor the commitment of those in the armed services who are transitioning to private sector life via the DoD SkillBridge program.

A program in which military members on the cusp of separation can apply to be interns at commercial companies while still being paid their military pay and benefits for the final few months of their enlistment.

The program creates positive opportunities for both parties involved.

The transitioning military member gets to experience real-life working in the business world. For some, this can be a refreshing change; for others a bit more difficult to adapt to. In the case of the latter, even more reason to take a few months to gradually adapt to life outside of the structure and rigor of military life. In addition, military members may gain assistance and mentoring with regards to interviewing and job searching. In the case of my company, they are afforded training, study time, and vouchers to test for information technology and/or cybersecurity industry certifications – the backbone of DoD contractor hiring and qualifications. In short, ANS desires to do everything we can to set our interns up for success in their new work-life beyond the military.

Participating companies gain the potential to hire vetted, disciplined, quality candidates while potentially leapfrogging the wickets of general recruiting processes and procedures. So much more than just “free labor” that the term “intern” may conjure in the minds of some, companies gain a chance to build engagement, loyalty, and goodwill from a qualified pool of candidates appreciative of the opportunities being offered. ANS simply believes it’s the right thing to do for those who have given of themselves in service to our country.

Anthony, one of our current SkillBridge interns put it this way: “It’s like the DoD partnering with industry to give back to the military members a chance to gain a skillset for better employment opportunities. There’s not a lot of call for a mortarman or artillery gunner in the commercial sector!” Anthony started his internship days before our company-wide annual kick-off party. It was there that we learned that Anthony already knew many of our employees. They were contractors working with him previously! We are selective in who we employ and bring on as interns, as we look for people with aptitude and a love for the mission they support. Anthony is no exception.

Former SkillBridge beneficiary at our company, David, recently related to me, “I genuinely feel lucky to have found ANS!” We assisted David in his relocation and transition, allowing him ample time for out-processing and attending to his few remaining military responsibilities. We provided training which he leveraged to gain additional desired IT certifications. We happily cheered him on as he successfully applied to and negotiated a great paying job 

 – but that’s totally okay as it was never about us in the first place! All credit goes to him!

With internship locations in both San Antonio, TX and Columbia, MD we have been fortunate enough to employ many of our interns. One intern immediately joined ANS at the end of his internship and was accepted onto a cyber protection team in TX. Another learned the ropes of becoming a Software Developer during his internship and proved essential in creating our new website - a task that not many others were up for completing!

Don’t Just Say “Thank You” … Show Your Gratitude!

Working and living in San Antonio, Texas, I meet and know a great many current and former military members. I often say to them, “Thank you for your service!” and sincerely mean it, but simply 

 “Thank You” to show my appreciation is easy, and ultimately profits them nothing. It is 

something to show that appreciation that takes deliberate effort.

Comprised of 52% Veterans, ANS takes great pride in hiring and taking care of our prior military servicemen and women. As a business community, may we always be about 

Want to become a SkillBridge Industry Partner?

More information on SkillBridge can be found at 

Reflections On The SkillBridge Experience

My name is Emily. I am a 31-year-old cybersecurity enthusiast, and I have been in the Information Technology and Cybersecurity field for eight years. I specialize in network threat detection and mitigation and enjoy forensic analysis and studying adversary behavioral patterns. Some of my hobbies include hiking, kayaking, reading Fantasy Fiction, and crafting. I am married to my best friend and have a 4-year-old German Shepherd, Cipher.

Some of the brightest minds in Information Technology were and are women. From the mid to late 1800s to the current day, women have been pioneers in the world of computing. Great minds like Ada Lovelace, Grace Hopper, Katherine Johnson, Margaret Hamilton, Adele Goldberg, Hedy Lamar, and many more have designed and developed computations still used today. Without women, the computing world we live in today may look very different. Women worldwide are breaking down barriers and announcing that women can do anything with the correct equation of motivation and passion.

The Cybersecurity workforce is ever-changing, and amongst these changes, the most popular topic of change is the rise of women in the industry. More women are applying and being hired for cybersecurity roles every day. Women are also earning higher-level positions faster than their male counterparts. According to The International Information System Security Certification Consortium (ISC)² survey conducted in 2018, 24% of the cyber workforce is women 

. The study includes women in positions where at least 25% of their daily duties are Cybersecurity responsibilities. The study comprises traditionally prominent government roles and small businesses nationwide and worldwide 

. So why are women still only making up a quarter of the workforce? There are many contributing factors to the slow rise of women in cyber. Experts say, “access to opportunities, education, and the lack of value on diversity could be some contributing factors 

Featured Post

Cybersecurity Awareness in the ICS Environment

Our Insights