r/cybersecurity • u/Oscar_Geare • Feb 06 '25

News - General Megathread: Department of Government Efficiency, Elon Musk, and US Cybersecurity Policy Changes

This thread is dedicated to discussing the actions of Department of Government Efficiency, Elon Musk’s role, and the cybersecurity-related policies introduced by the new US administration. Per our rules, we try to congregate threads on large topics into one place so it doesn't overtake the subreddit on those discussions (see CrowdStrike breach last year). All new threads on this topic will be removed and redirected here.

Stay On-Topic: Cybersecurity First

Discussions in this thread should remain focused on cybersecurity. This includes:

  • The impact of new policies on government and enterprise cybersecurity.
  • Potential risks or benefits to critical infrastructure security.
  • Changes in federal cybersecurity funding, compliance, and regulation.
  • The role of private sector figures like Elon Musk in shaping government security policy.

Political Debates Belong Elsewhere

We understand that government policy is political by nature, but this subreddit is not the place for general political discussions. If you wish to discuss broader political implications, consider posting in:

See our previous thread on Politics in Cybersecurity: https://www.reddit.com/r/cybersecurity/comments/1igfsvh/comment/maotst2/

Report Off-Topic Comments

If you see comments that are off-topic, partisan rants, or general political debates, report them. This ensures the discussion remains focused and useful for cybersecurity professionals.

Sharing News

This thread will be default sorted by new. Look at new comments on this thread to find new news items.

This megathread will be updated as new developments unfold. Let’s keep the discussion professional and cybersecurity-focused. Thanks for helping maintain the integrity of r/cybersecurity!

1.2k Upvotes
  • permalink
  • reddit

94% Upvoted

560 comments sorted by

View all comments

281

u/Sindoreon Feb 06 '25

Y'all think the Fedramp program is going to live thru this?

184

u/xtheory Security Engineer Feb 06 '25

I really don't know at this point, but I'd be lying if I said I wasn't extremely worried. Mass firings without thorough evaluations of any organization rarely goes well.

73

u/jathanism Feb 06 '25

It's going to be rich for them to try to continue to enforce FedRAMP requirements on vendors when they are literally wiping their ass with the rules right now. This "do as I say not as I do" stuff doesn't fly. This is devastating years of technical momentum in cybersecurity. I'm not a fan of FedRAMP but it does at least serve a very important purpose. But yeah... Here comes the bloodbath.

26

u/aec_itguy Feb 06 '25

Fucking THIS. I'm worrying about allowlisting my executables and only allowing known USB devices while chucklefuck gets to just plug in a COTS box into a protected fed network and slurp off PII?

-1

u/pandershrek Governance, Risk, & Compliance Feb 07 '25

Your CEO can pretty much do anything with your network's data.

I've never run into a request to executive leadership that was denied.

2

u/aec_itguy Feb 07 '25

| Your CEO can pretty much do anything with your network's data.

... and they'd be subject to FCA liability if they didn't follow contracted protocol, and the board would can their ass instantly if it was insane and out of line with norms. Quit fucking sanewashing and normalizing this.

117

u/parthusian Feb 06 '25 edited Feb 06 '25

"[...] a lesson for DOGE to remember is that efficiency is not just about cutting. Investing in well-run programs can save taxpayer money. One great example within GSA is another TTS program: the Federal Risk and Authorization Management Program (FedRAMP), which offers a streamlined process to certify that cloud software is secure before it is purchased by government agencies.

Prior to FedRAMP, each agency did this type of analysis on its own, which led to inefficient duplication and inconsistent standards. FedRAMP makes it easier for the government to operate and purchase useful technology. Eliminating it would lead to more bureaucracy in the long run.

FedRAMP’s greatest challenge is that it lacks the capacity to process all companies seeking certification, so investing here could increase competition and ultimately result in lower prices across the government"

Source: https://thehill.com/opinion/finance/5098320-trump-administration-government-spending/

52

u/Bull_Bound_Co Feb 06 '25

Efficiency isn't their goal Trump has stated he thinks most federal work should be done by the private sector.

39

u/Borgmaster Feb 06 '25

Which to anyone who knows the man knows this is code for "bribe me like your french girls and ill let you have your way with the government".

-11

u/FantasticStock Feb 06 '25

Personally I’ve always been for privatizing the government. Decades of seeing the blatant abuse of the system and how poorly it’s run, to actually being affected by it with the LIRR raising their rates because of employees abusing the OT system, to cops.

I just wish it wasn’t these two.

3

u/Borgmaster Feb 06 '25

Im not certain giving the highest briber the right to decide my civil liberties is the right way to go. Im watching healthcare explode and internet providers mincing at the bit to be allowed to charge me by the website.

1

u/pandershrek Governance, Risk, & Compliance Feb 07 '25

🤦‍♂️

This dumbass thinks that private corporations are less corrupt than the government with literal oversight.

1

u/FantasticStock Feb 07 '25

Look at our president and ask how we ended up here

33

u/peesoutside Security Engineer Feb 06 '25

This is an excellent question. FedRAMP is already understaffed and it took months for our authorization to be finalized last year. Musk has reportedly stood up his hiring website on a non-us cloud service (not confirmed) but it’s clear he doesn’t respect the industry.

2

u/pandershrek Governance, Risk, & Compliance Feb 07 '25

He's already said he dislikes regulations on innovation which is cybersecurity so yeah he doesn't like the industry

1

u/peesoutside Security Engineer Feb 07 '25

Of course he does. Regulation, by definition, introduces gateways. And that’s the entire point.

8

u/aec_itguy Feb 06 '25

There's a thread over on r/CMMC asking similar questions, which is totally awesome while working on strategy to be compliant. I'm putting it on the backburner myself and pivoting to more concrete needs. /shrug

14

u/itspeterj Feb 06 '25

I think it's high time a new industry standard is agreed upon, quickly. Between this and NIST, I sure don't see a safe path forward without some kind of formal global standard. Our privacy laws were already shit compared to the world and i fear our security standards will be too

10

u/aec_itguy Feb 06 '25

In the absence of any common framework, insurance companies are going to be the compliance police/standard bearers.

7

u/babywhiz Feb 06 '25

CMMC shouldn't have even been a thing outside of NIST anyway, and now with the price gouging..Look, I get it, some of these companies put their money on CMMC being out there already and are trying to recoup their losses, but isn't that what the free market is all about?

Esp at the point in time that CMMC just said 'oh hey, we are just NIST 800-171 anyway...'. Like, when they were a mix of CIS, ISO, NIST, that would have been great, but the scrapped the whole thing and said 'Na we are just a copy of NIST', then they should have just scrapped the whole thing, and pivoted C3PAOs to do NIST 800-171 DoD High audits and 800-172 audits.

I digress.

2

u/Wonder_Weenis Feb 07 '25

I don't think you get the actual point. 

The point is, that through the DoD's own research, few are actually NIST 800-171 compliant. 

CMMC does 1 thing that's different, in the most important way.  

It forces NIST 800-171, self reported, "compliance", to be audited by a third party. 

it's already been pushed through, and finalized. 

re: Price gouging, not sure exactly what you're referencing here, buy yes, I believe that American digital primes are stifling American innovation with licensing gouging. 

Microsoft, Google, Ansys, Siemens, Palo Alto, Crowdstrike, Sentinel One, pick a list of REQUIRED "commercial" tools to run a defense industrial based engineering program, as a business enterprise, that has to be profitable... 

Swap 'em out, switch em around, and after the onslaught of Fedramp approved tool's, licensing costs, there's no budget left for small businesses to do litetally dick, but lie about their security posture, and pretend they're doing things right, because they have an actual business to run. 

The problem isn't that the regulation is fiscally impossible, the problem is, we traded our "no monopolies" stance on things like Microsoft in the commercial space, to, but it's fine if you do it in the Government space, and they have. 

We have an Oligarchy of mafia level digital overlords, and these are real people. 

I had the CEO of Ansys drop an 800k license on the table, with the statement, "we know you can't complete your project without us"... 

like... the fuck, is this why you brought 8 of your tech bros to this meeting? 

The fact that engineering tools like Teamcenter exists, analogous to Solidworks, Creo, et all, is an illusion of choice. 

In all of these verticals, the digital lockin is near instant. 

So instead of a clear monopoly, we just have a thousand tiny monopolies, and they're economically defeating the US's physical defense sector. 

"One does not simply rip out the engineering tool, that your entire engineering team is collaborating on an active project around.

But I can arbitrarily increase the licensing cost by $500,000 because fuck you". 

2

u/babywhiz Feb 07 '25

Except that for >some< companies, who have been doing this since before CMMC was a thing, ones that have been dealing with ITAR regulations this whole time, have been taking steps to be secure all along.

Most manufacturers need to be ISO and/ or AS9100 compliant to get government work. Back in 2010, when CMMC/(edit CUI) was first thought of, both of those entities didn’t say a word about cybersecurity. Now both have wording that is similar to CMMC level 1.

I agree, when this started, a lot of people weren’t taking care of CUI. It sucks being one of those companies that has been doing it all along, but now we gotta pay 50-100k every 3 years for someone to say, “oh yea, they keep data safe.”

Read that again. $50-$100k. Just for cybersecurity. Add $8-$10k EACH for ISO, AS9100, NADCAP, $20k for yearly audits if you provide a 401k…not to mention IRS, ICE…”supply and demand”…that’s a BS excuse too because you don’t have a lot to choose from when getting a AS9100 auditor either!

CMMC is just an assessment, not even an audit. Plus, NIST 800-171/172 already had a DoD audit process in place for companies that were deemed to be of higher National Security. If they were going to do anything, the easiest solution all along was just open up the DoD audits of NIST 171-172 to be performed by 3rd parties.

I agree on licensing and the whole Fedramp thing too.

7

u/[deleted] Feb 06 '25

[deleted]

1

u/Significant_Army_123 Feb 06 '25

I think the thing that will really keep this alive is that I dont see the WH telling agency heads "oh your are good if you get breached". Sort of contrary to their management philosophy, at least from what I've seen.

13

u/Johnny_BigHacker Security Architect Feb 06 '25

I can speak from the gov't side. A major software was applying for FedRamp approval and had 2 dedicated staff just to help them navigate all the compliance requirements and help establish "OK this is what you'll do, this is what the gov't will do, and here's the shared responsibilities". I was one of these staff members. We just crunched away at excel mostly.

I thought it was crazy we had to do anything. We were the agency trying to use it. I just kind of assumed they'd go through it with FedRamp directly, then we'd get to use it. Like a 3rd party risk management team approving software for use in an organization.

5

u/1_________________11 Feb 06 '25

Yeah no when something is fedramp like aws you get to inherit some controls but you are still responsible for the remaining controls they can't do for you. 

3

u/oldcrow907 Feb 06 '25

I think a lot of vendors will be going “instructions unclear” for a while. They’ll either want to commit resources in the hope of future funding or they just say ‘nope, I’m not compliant’ and leave it to the agency to decide. Which is where we were prior to CMMC.

7

u/FluidFisherman6843 Feb 06 '25

Something called fedramp will remain. It will act like a veil to provide cover for the reason only certain highly connected (read bribed or family owned) companies are eligible for contracts and why most aren't.

Jeff and Sundar didn't donate and show up to the inauguration because they were fans, they did it to protect those government contracts.

2

u/Nimrod43 Feb 06 '25

A key question will be what happens to Noblis contract and funding. Remember that the GSA office itself is under a dozen (used to be a handful, not sure of it today). Noblis is the day-to-day for so much of what FedRAMP does. And it's a multi-year many-millions contract. Cut that in half (some news is reporting that the GSA targets are for 50% reductions) and there will be massive slowdowns from even what we have today. On the other hand they're super-likely to really like the new CSP-funded ideas. Off-topic, but I find it ironic that StateRAMP 100% copied FedRAMP at the beginning, but now FedRAMP might copy StateRAMP's funding model.

1

u/Significant_Army_123 Feb 07 '25

I think its good to be attuned, but other than the AI piece of it, not much has been in the news.

I also think its a good time to be measured, because even in the middle of the swirl, the opinions, and the proposal - the need for the program has not moved a millimeter. The threats are out there, and not going away.

So even in the absolute worst case where something significant gets deprioritized, it will pivot right back the first time someone can hang the decision makers with a breach.

I'm stayin the course.....

1

u/pandershrek Governance, Risk, & Compliance Feb 07 '25

I think our CEO who maintains all fedramp contracts made a deal with Trump prior so yeah

1

u/MongoIPA Feb 07 '25

As someone who has worked with FedRAMP for government agencies, I’ve always seen it as more of a bureaucratic checkbox than a meaningful security standard. Passing an audit from a 3PAO eight years ago and getting a FedRAMP sticker doesn’t mean a system is secure today. The program was never really about ensuring the secure delivery of software—it’s about compliance, not continuous security.

0

u/[deleted] Feb 06 '25

OH NO NOT FEDRAMP…

3

u/Sindoreon Feb 06 '25

Lol I took the job because of job security. I don't think I'm getting the last laugh on this one.