Miles Jamison 
- Summit 7 checked 130 Iranian attack techniques against NIST SP 800-171 controls
- Four controls provided most of the mitigation and detection coverage
- Utilities in at least 12 states reported incidents tied to Iranian-affiliated actors by mid-August
Darron Makrokanis, chief revenue officer at Summit 7, has urged defense contractors to continue working toward Cybersecurity Maturity Model Certification, or CMMC, citing Iranian cyber activity aimed at the companies and suppliers that support U.S. military operations.
In a commentary published Friday in Federal News Network, Makrokanis said the Iranian threat continues even though CMMC Phase 2 may be on hold. The Department of War suspended Phase 2 requirements on July 13 and established a CMMC Reform Task Force to review the program.
What Did Summit 7’s Research Find?
Summit 7 reviewed 130 attack methods employed by five Iranian hacking groups. Makrokanis said every one of them could be detected with adequate monitoring, while 68 percent could be mitigated by safeguards already in the National Institute of Standards and Technology’s Special Publication 800-171. System monitoring, configuration settings, baseline configuration and malicious code protection accounted for most of those results.
Why Are Defense Contractors Exposed to Iranian Cyberattacks?
The FBI, Cybersecurity and Infrastructure Security Agency, National Security Agency, Environmental Protection Agency and other federal agencies cautioned in April that Iran-linked hackers were tampering with web-exposed industrial equipment used by government, water and energy operators, disrupting operations. The agencies updated the advisory in July in response to ongoing Iranian activity aimed at internet-connected operational technology devices. Makrokanis said utilities in at least a dozen states had reported incidents by mid-August and some operators were forced to run systems manually after losing remote access.
Makrokanis singled out smaller subcontractors as a concern, saying many lack the resources and regulatory pressure that drive large primes to build strong security programs. He said a single compromised managed service provider could reach dozens of downstream facilities. A supplier’s valid credentials could also give attackers a way into a prime’s network, he said.
What Steps Does Makrokanis Recommend?
Makrokanis said contractors whose programs center on protecting intellectual property should prepare for attacks that could aim to destroy data, halt operations or damage systems, noting that Iranian operators often deploy wiper malware. He also recommended securing operational technology with the same rigor as IT, pinpointing the weakest suppliers and replacing periodic compliance reviews with ongoing monitoring.
