The Defense Logistics Agency (DLA) is a vital component of the U.S. Department of Defense (DoD), responsible for managing the global defense supply chain. The DLA provides critical resources to the U.S. military and its allies, ensuring the availability and timely delivery of supplies, equipment, and services essential for national defense.  The Naval Information Warfare Center (NIWC) Atlantic plays a crucial role in the United States defense infrastructure by delivering advanced information warfare capabilities to the U.S. Navy and DoD agencies like the DLA and ensuring the U.S. military maintains its technological edge and operational readiness in an increasingly complex and dynamic threat environment.

The DLA faced significant cybersecurity challenges, necessitating robust and resilient solutions to protect its extensive Industrial Control System (ICS) infrastructure, particularly the Automated Fuel Handling Equipment (AFHE) operational technology (OT) systems. With increasing OT cyber threats, DLA required a comprehensive cybersecurity strategy to safeguard sensitive data, maintain operational efficiency, and ensure compliance with DoD standards. NIWC recognized that an industry partnership was necessary to fortify the DLA’s IT infrastructure against cyber threats and support these critical defense operations.

In partnership with NIWC, TIAG delivered a comprehensive suite of advanced cybersecurity services to the DLA, driving substantial improvements across various domains:

• Advanced Threat Detection and Response: TIAG established an advanced threat detection and response system, enabling real-time monitoring and rapid response to potential cyber threats. This ensured DLA maintained uninterrupted operations, minimized downtime, and delivered essential resources promptly.
• Comprehensive Cybersecurity Assessments: We thoroughly evaluated DLA’s existing OT cybersecurity landscape, identifying vulnerabilities and areas for improvement within the AFHE program. This included a detailed DLA AFHE lab hardware and software inventory, accounting for end-of-life and replacement information. Our team developed an inventory management system and completed two site audits, optimizing lab configuration for enhanced efficiency.
• Risk Management Framework (RMF) Implementation: TIAG implemented the DoD’s RMF to enhance DLA’s security posture, ensure compliance with federal cybersecurity regulations, and significantly reduce the risk of security breaches.
• Enhanced Security Culture: We provided comprehensive training and awareness programs to DLA personnel, equipping them with the knowledge and skills to identify and respond to cyber threats effectively, fostering a robust security culture within the organization.
• Cost-Effective Solutions: By leveraging past improvements, generating standardized processes, and efficiently overseeing site activities, TIAG’s centralized team delivered significant cost savings to DLA.
• Industrial Control Systems (ICS) Engineering: Our expertise in Wonderware/AVEVA system platform software development, PLC development and integration, and ICS Historian development and maintenance was pivotal in upgrading existing systems and implementing new cybersecurity practices.
• AFHE 4.2.0 Next-Generation Application: TIAG led the development of the next-generation AFHE application, including migrating to a type 1 hypervisor for improved system analysis and reproducibility, implementing domain-controlled group policy via Active Directory, adding an in-boundary ACAS scanner and SIEM tool (ELK-stack application), fully re-engineering the AVEVA 2023 System Platform application, and implementing a robust networking architecture with hardened Cisco switch configuration.
• Model-Based Systems Engineering (MBSE): We implemented MBSE methodology to build and support a digital twin system for ICS/OT systems, enhancing system design and analysis capabilities.
• Comprehensive Knowledge Base: TIAG developed a comprehensive knowledge base of ICS and OT systems in the AFHE program, resulting in over 30 published documents, including white papers, SOPs, and AoAs. These documents encompassed the AFHE HMI/SCADA AoA, AFHE Ground Reader Replacement Options Analysis, AFHE 4.2 System Architecture Options – Hypervisor, Isolated Network Connectivity Supporting Automated Fuel Handling Equipment, Patch Management of a Distributed Non-Interconnected System, Use of Windows Server Update Services, and Manual Patching Process for Automated Fuel Handling Equipment.
• Thought Leadership: We showcased our expertise and strategic thinking by developing several white papers and Analysis of Alternatives (AoA) documents in critical areas such as HMI/SCADA systems, ground reader replacement options, and patch management strategies.

TIAG generated 100% of the required policies and procedures for the ATO body of evidence, resulting in the longest ATO ever awarded to the AFHE program, expiring November 7, 2024. Through rigorous assessments and RMF implementation, DLA significantly strengthened its defenses against cyber threats, protecting sensitive data and critical systems. Additionally, TIAG’s multifaceted approach not only enhanced security but also improved overall operational supply chain efficiency and resilience, positioning the DLA AFHE program for continued success in an ever-evolving threat landscape. 

The Naval Information Warfare Center Atlantic (NIWC-LANT) and the Commander, Navy Installations Command (CNIC) operate in complementary roles to ensure national security and operational excellence within the Navy. NIWC Atlantic delivers cutting-edge information warfare solutions, encompassing a broad range of capabilities from communication and networking systems to cyber operations and information security. This technical prowess is critical in safeguarding and enhancing the Navy’s strategic communications and data integrity across various platforms. Simultaneously, CNIC is tasked with developing and maintaining Navy shore infrastructure as the Navy’s shore integrator. By managing ten regions, 71 installations, and 123 Naval Operations Support Centers, CNIC provides the necessary physical and organizational frameworks that support the Navy’s global operations. NIWC Atlantic and CNIC forge a strong alliance, with NIWC providing the technological edge and CNIC ensuring those capabilities are effectively embedded within a solid infrastructure. This synergy enhances the Navy’s operational capabilities and fortifies its position in maintaining national security through technological and infrastructural excellence.

NIWC faced the critical task of securing CNIC’s 90+ systems from evolving cyber threats and required a partner capable of identifying and mitigating risks across varying system sizes and complexities, maintaining ongoing cybersecurity support, obtaining timely system authorization renewals, and reporting on status and priorities at the Echelon II level. CNIC’s diverse and complex systems required close coordination and guidance with system owners for cybersecurity activities, including providing status updates and setting priorities.

TIAG’s team worked with NIWC to authorize global systems of varying sizes and complexities, ensuring their security and modernizing the infrastructure to maximize mission performance. The team worked to authorize global systems of various sizes and complexities, ensuring modernized and secure infrastructure for optimal mission performance. TIAG assessed existing technologies, identified security risks, and provided actionable recommendations to CNIC and Navy authorities. By establishing streamlined processes to track progress and address potential issues proactively, TIAG created an event-based schedule and resource tracker to support the 6-step Risk Management Framework (RMF) activities. Regular meetings with stakeholders and Echelon II representatives facilitated clear communication and ensured a rigorous approach to the project.

TIAG’s partnership with NIWC has led to transformative improvements in cybersecurity practices, setting new standards for securing complex Navy systems and providing CNIC with the tools and support necessary for continued success. Within six months, 12 systems received authorization, with additional systems nearing completion. CNIC can now efficiently monitor and adjust staffing through the graphical resource tracker, optimizing team performance and reducing bottlenecks. NIWC and CNIC customers have praised TIAG’s accomplishments and are requesting assistance with additional duties due to the successful outcomes. The project’s results include improved cybersecurity, enhanced mission performance, and increased confidence in CNIC’s ability to protect its systems from threats.

As a Tier 3 IT operations support mechanism for the entire region and with 28,000 staff dedicated to providing world-class patient care, the Regional Health Command Atlantic (RHC-A) isn’t just one of the largest healthcare systems in the world – it’s also responsible for protecting the sensitive data of more than 600,000 service members, retirees, and their families. 

To ensure that the data of these individuals is safeguarded with the highest security standards and confidentiality, RHC-A sought out cybersecurity support to evaluate its current cybersecurity landscape, identify weaknesses in its existing security posture, and implement the necessary protocols and procedures to close these gaps.

TIAG leveraged our proven RMF implementation methodology and continuous monitoring strategies to ensure compliance with all DoD standards, effectively safeguard the organization’s information assets, and expedite obtaining ATOs.

Security Testing and Evaluation. TIAG evaluated RHC-A’s existing cybersecurity landscape and identified potential problem areas. Our cybersecurity experts conducted a thorough evaluation of the organization’s network, applications, and overall security posture. We proactively protected the system from rapidly changing cyber threats by implementing a host-based security system and continuously scanning all devices – including remote mobile devices, desktop computers, and devices connected to external networks – for vulnerabilities using Microsoft System Center Configuration Manager (SCCM). This system was designed to block viruses and malware and allow us to quickly manage, deploy, and secure devices and applications across the entire enterprise. 

Gap Analysis and Mitigation. After identifying gaps in RHC-A’s systems and security posture, TIAG developed strategies to close these gaps. They implemented robust security controls and developed detailed Security Assessment Report (SAR) and Risk Assessment Report (RAR) reports on their findings to ensure prompt mitigation and improve protection across the organization’s networks.

Security Control Implementation Plan. We identified how and where each security control – including technical, physical, and administrative controls – would be documented based on existing policies and procedures and outlined how RHC-A’s security posture would be assessed, evaluated, and maintained over time to protect the enterprise and the systems within it from potential threats.For any controls that could not be implemented, either temporarily or permanently, we thoroughly documented in a Plan of Action and Milestones (POA&M) report with recommendations for mitigation. 

Ongoing Risk Assessments, System Hardening, and Penetration Testing. We implemented system and application hardening measures in accordance with Security Technical Implementation Guides (STIGs), and conducted regular risk assessments and penetration testing to identify vulnerabilities in the network, LAN, and physical systems. TIAG’s proactive approach detected and responded promptly to unauthorized activities and attempts at accessing sensitive information and addressed emerging threats and vulnerabilities before they could be exploited.

SCCM Deployment for Efficient Patch Management and Enhanced Authentication Methods. Deploying SCCM allowed TIAG to ensure that patches and updates were applied consistently across all devices on the network. This contributed to the overall security of the network infrastructure and helped protect the organization’s systems and applications from risks and vulnerabilities. We also implemented more enhanced authentication systems for user accounts and restricted administrator privileges, ensuring that only authorized personnel had access to critical areas of the network. This strategy further protected sensitive data from potential cyberattacks and unauthorized access.

Advanced Risk Management Framework. We developed a comprehensive risk management framework and LAN Authority to Operate (ATO) packages for all sites – including all necessary documents and evidence related to security control implementation, assessments, and improvements for review by the Security Control Assessor (SCA) and Authorization Official (AO), including documentation. As part of this process, we ensured that controls and artifacts were verified to meet Defense Health Agency (DHA) cybersecurity regulations. 

TIAG successfully converted all MTFs within the region from DIACAP to RMF, receiving the most approved three-year ATO accreditations among all regions. Our proactive approach and cutting-edge techniques to improve RHC-A’s cybersecurity posture not only strengthened their defenses and led to a significant reduction in vulnerabilities across the region, but also enabled them to more efficiently track and monitor their security status.

The Federal Emergency Management Agency (FEMA), plays a pivotal role in the United States by coordinating disaster response and recovery efforts, providing assistance to affected individuals and communities, and promoting emergency preparedness nationwide

FEMA was facing significant issues with their cybersecurity infrastructure, scoring the lowest in the Department of Homeland Security on the Federal Information Security Management Act (FISMA) Information Security Scorecard, with only an 18% score. These challenges stemmed from a number of underlying issues, including:

• Operating systems under expired Authorization to Operate (ATO) designations
• Inadequate documentation and processes
• A lapse in contract, resulting in the absence of an Independent Verification & Validation (IV&V) team
• Incomplete or behind-schedule assessments

With FEMA’s security infrastructure at severe risk, TIAG’s intervention was critical to achieving full FISMA compliance and safeguarding the organization’s operations.

TIAG stepped in, tackling the challenges head-on with innovative strategies and methodologies. Key actions taken by TIAG included:

• Conducting TIAG’s Own IV&V Testing: In the absence of a third-party IV&V team, TIAG conducted our own assessments, addressing the backlog of tasks and ensuring continuous progress in the ATO process.
• Establishing a Knowledge Management Repository: TIAG centralized all critical documentation, streamlining access to up-to-date material and ensuring transparency across all teams.
• Developing a Compliance Portal: To systematically identify and mitigate existing vulnerabilities, TIAG implemented a compliance portal to provide a streamlined, cohesive view of the security landscape.
• Implementing a Matrixed Structure: TIAG fostered alignment between FEMA’s security policies and procedures by developing a matrixed infrastructure that accounted for risk type, criticality, on-premises/cloud storage, and target states.
• Identifying High-Impact Systems: TIAG pinpointed Software as a Service (SaaS) and cloud-based systems that achieved ATO quickly, with a focus on those set for modernization within 12-18 months.
• Onboarding Assessors: Until a third-party contract was settled, TIAG brought in-house assessors to conduct assessments, ensuring that progress stayed on track.

TIAG’s approach led to a resounding success, with FEMA’s FISMA score soaring from 18% to a remarkable 97%. By achieving full compliance with federal information security standards and regulations, FEMA saw vast improvements in their operational efficiency and significant reductions in government expenditure. Some notable achievements included:

• Successfully completing over 2,200 Plans of Actions and Milestones
• Acquiring 110 Authorization to Operates (ATOs)

These accomplishments, alongside TIAG’s expertise in cybersecurity best practices and innovative solutions, ensured that FEMA’s IT infrastructure saw a significant boost in security, better safeguarding critical data, and streamlining the accuracy of their operations.

The Financial Crimes Enforcement Network (FinCEN) is responsible for safeguarding the country’s financial system from illicit use, combating money laundering and its related crimes including terrorism, and promoting national security through the strategic use of financial authorities and the collection, analysis, and dissemination of financial intelligence.

FinCEN contracted TIAG to strengthen its cybersecurity infrastructure in preparation for an upcoming audit. 

TIAG’s Mentor-Protégé joint venture with Saliense, SynergisT JV, provided a secure environment where FinCEN’s applications could be scanned, tested, and patched. SynergisT JV also supported FinCEN’s risk management framework through vulnerability mitigation and management, which included modernizing and tailoring FinCEN documentation and cross-training staff to increase personnel flexibility and capabilities. Additionally, the team:

• Conducted a thorough analysis of FinCEN’s security infrastructure and identified issues with the Nessus Tenable instance.
• Designed, built, and established a resilient vulnerability management infrastructure utilizing Nessus Tenable and bespoke processes for enhanced automation.
• Revamped FinCEN’s SSP (System Security Plan) and supporting artifacts for a robust and secure foundation.
• Modernized and customized FinCEN documentation and cross-trained staff to increase personnel flexibility and capabilities.

TIAG’s cybersecurity overhaul for FinCEN propelled the organization into a secure and compliant cloud environment. With over 1,000 previously undetected vulnerabilities addressed and substantial improvements to the security infrastructure, TIAG’s work with FinCEN yielded impressive results:

• Significant improvement in FinCEN’s cybersecurity posture and compliance levels.
• Reaffirmed leadership’s confidence leading up to the annual Cyber Security audit.
• Expansion of TIAG’s services to support a new area of FinCEN’s operation, resulting in two additional contract positions.
• Ongoing talks about a direct 5-year award to TIAG.
• Increased efficiency in maintaining FinCEN’s cloud environment.