It Dojo

It Dojo In business since 2002, ITdojo provides Information Technology Consulting and Training for the gover Our Approach to IT Training is This. We Train. You Learn.

It’s as Simple as That…Honest. Serving our clients for over a decade, IT Dojo utilizes unique means of knowledge transference, ones that add value to the experience, ones that prepare your staff not only for IT certification, but more importantly for the real world. By immersing our clients in intensive, hands-on IT training courses we are confident that they will gather the knowledge needed to succeed.

09/18/2026

A lot of federal infrastructure teams have quietly become cloud teams without anyone updating the job description.

The pattern is familiar. A system that used to run entirely on-prem now has half its workload in AWS GovCloud or Azure Government, with the on-prem half still very much someone's responsibility. The admin managing that hybrid environment needs to understand cloud architecture, virtualization, and cloud security operations, not just the platform-specific console they happen to be using this week.

CompTIA Cloud+ is built for exactly that person. It is vendor-neutral, which matters when your environment spans on-prem, one or two cloud providers, and whatever gets added next fiscal year. It covers deployment, security, and operations at a level that applies whether you are looking at a virtualization cluster or a cloud tenant.

For federal IT professionals who came up managing physical and virtual infrastructure and are now being asked to own cloud pieces too, Cloud+ closes that gap without requiring a full platform-specific certification track first.

At IT Dojo, we deliver Cloud+ live and instructor-led, built for the federal environments our students actually work in. Visit itdojo.com or reach out at [email protected].

09/16/2026

A question that trips up a lot of new ISSOs: if you already assessed your own controls, why does someone else have to assess them again?

The answer is independence, and it is not a formality. The Security Control Assessor role exists specifically so the person testing whether a control works is not the same person who built it or is accountable for its budget. An ISSO who is under pressure to hit an authorization date has an incentive, even an unconscious one, to read ambiguous evidence generously. An SCA who reports up a different chain does not carry that pressure.

This is why NIST and DoD guidance are specific about SCA independence, not just SCA existence. An assessor who reports to the same program manager as the system owner, or who helped write the SSP, has a conflict that undermines the entire point of the assessment. Some agencies get this wrong by treating the SCA function as a rotating collateral duty inside the same program office. Technically a different person signed the SAR. Practically, nothing independent happened.

For an Authorizing Official, the SCA's independence is part of what makes the SAR worth trusting. A finding from an assessor with no stake in the outcome carries weight that a finding from an interested party does not, even if the finding itself is identical.

If you are building or reviewing an assessment function, the org chart question is not decorative. Who does the SCA answer to, and does that person have any interest in the outcome, is worth asking before you ask anything about methodology.

09/10/2026

There is a specific promotion that goes badly more often than it should.

Your strongest technical person becomes a program lead. They know the system better than anyone, which is exactly why they were picked. Six months later they are struggling, and it is not competence. It is vocabulary.

Federal program rooms run on a particular language. Scope, schedule, risk register, earned value, dependency, critical path. When you cannot speak it fluently, two things happen. You lose arguments you should win, because you cannot express a technical constraint as a schedule impact. And you get committed to things you know are unrealistic, because the moment to object passed while you were still translating in your head.

PMP is the bridge. Not because the certification is magic, but because it forces structured exposure to how these programs are actually planned and defended. The people who come through it stop being the technical expert who gets overruled, and start being the lead who shapes what gets committed.

This is also one of the few certifications where the benefit shows up immediately, in meetings, rather than eventually in a job search.

If you have someone who was promoted for technical strength and is now negotiating scope with a contracting officer, this is worth a conversation.

We run PMP as live remote online with a 16 seat cap, and the session is recorded for three months so it can be revisited during the application process.

Just reply and let me know if you want details.

09/09/2026

Continuous monitoring guidance is written as though you have a con-mon team. Plenty of federal shops have one person who also does assessments, package work, and whatever else lands that week.

If that is you, here is a cadence that holds up.

Monthly, and genuinely every month. Vulnerability scan review with actual triage, not just archiving the report. Account and privilege review on your highest value systems. POA&M status updated to match reality, including the milestones you are going to miss. A quick look at whether anything new appeared inside your boundary that nobody mentioned.

Quarterly. A rotating slice of controls, assessed properly. Divide your control set into four groups and take one group per quarter. Configuration baseline comparison on critical systems. Review of who has access to what, at the group level rather than user by user.

Annually. The full picture, contingency plan testing, and the things that genuinely only make sense once a year.

Two rules matter more than the schedule itself.

Write down what you are not monitoring. A small team cannot cover everything, and the difference between a risk decision and negligence is whether it was decided out loud. An AO can accept a documented gap. Nobody can accept a surprise.

Keep the monthly list short enough that you actually do it. Four items completed every month beats twenty items on a plan that slips to quarterly and then to never. Consistency is the thing being assessed, not ambition.

09/08/2026

Federal DevSecOps keeps getting solved as a tooling question, and that is why it keeps not getting solved.

The pattern is familiar. A pipeline exists. Somewhere near the end, a security gate appears. Scans run, findings pile up, and a security team that was not part of any design conversation is now the reason the release slipped. Everyone is frustrated and everyone is behaving rationally.

The tooling is rarely the constraint. Scanners have been good for years. The constraint is that security was given a veto instead of a seat.

A veto at the end of a pipeline produces exactly what you would expect. Developers optimize to get past the gate rather than to build something defensible. Security optimizes to catch things, because catching is the only authority they have. Findings become a negotiation rather than information. Nobody is doing the actual work of designing for security, because the process never asked anyone to.

What changes it is unglamorous and structural. Security involved when the architecture is chosen, not when it is delivered. Findings routed to the team that can fix them, with context about why it matters. A shared definition of what blocks a release, agreed in advance rather than argued per incident. Someone accountable for the pipeline's security posture who is not also the person accountable for shipping.

That last one is where most programs stall, because it costs headcount and org chart changes rather than license dollars.

If your DevSecOps initiative has produced a dashboard and a backlog but no change in how designs get reviewed, the tooling was never the problem.

09/04/2026

Security people get told to learn networking constantly. Almost nobody says how deep to go, which makes the advice close to useless.

Here is a practical answer, in three parts.

If you read packets, you need real depth. Incident responders, detection engineers, anyone who opens Wireshark and has to explain what they are seeing. CCNA level knowledge pays for itself repeatedly, because you cannot analyze traffic you do not understand structurally.

If you write policy or manage risk, you need fluency, not depth. You should be able to follow an architecture conversation, understand what segmentation buys you, and know when an engineer is telling you something is impossible versus merely inconvenient. You do not need to configure a router to do any of that.

If you are in GRC or audit, CCNA is usually overkill. Your time is better spent on the control frameworks and on understanding your own environment specifically.

The mistake I see is analysts pursuing CCNA as a credential when what they actually needed was two focused weeks on subnetting, routing, and how traffic traverses their own network. The certification is worth it when your job involves those details daily. It is expensive in time when it does not.

The other side of that is real too. I have watched capable security people plateau because they never got comfortable with networking, and it quietly limited which conversations they could lead. Fluency is not optional. Certification is.

Work out which of the three you are, then buy accordingly.

09/03/2026

Most federal SOCs do not have an alerting problem. They have a trust problem, and the alert volume caused it.

Once analysts stop believing the queue, tuning stops being optional. Here is a sequence that works, in this order, because doing it out of order is why most tuning efforts fail.

First, baseline before you touch anything. Two weeks of data on which rules fire, how often, and what happened afterward. Without that you are guessing, and you will not be able to defend your changes later.

Second, suppress by asset criticality, not by rule. Turning a rule off everywhere is how coverage gaps get created. The same behavior on a test VM and on a domain controller are different events, and your suppression should say so.

Third, measure true positive rate per rule and publish it. A rule sitting at two percent is not detection, it is a tax on your analysts. Once the number is visible, the conversation about disabling it stops being political.

Fourth, write down what you turned off and why. This is the step everyone skips and everyone regrets. When an incident review asks whether you would have caught something, you want a documented decision rather than a shrug.

Fifth, revisit quarterly. Environments change, and a rule that was noise in March can be meaningful in September.

The goal is not fewer alerts. It is a queue your analysts believe. An alert nobody trusts is worse than no alert at all, because it creates the appearance of coverage while providing none.

09/02/2026

We have walked Implement, Assess, and Authorize over the last few weeks. Monitor is where the whole thing quietly falls apart.

The reason is cultural, not technical. Everyone treats the ATO as a finish line. The package ships, the letter arrives, the team exhales and moves to the next system. Monitor becomes something you remember eleven months later when the anniversary is coming up.

That is not what continuous monitoring means, and the gap shows up in predictable ways. Controls that were accurate on the day of assessment drift. New components get added without a security impact analysis. POA&M milestones slip without anyone renegotiating them. Then the annual review turns into a second full assessment, which is expensive and avoidable.

What ongoing authorization actually asks for is a cadence. Something happens every month, not every year. A defined set of controls gets checked on a rotation. Scan results get reviewed by a person who can act on them, not just filed. Changes trigger an assessment of what they touched. Your POA&M gets updated when reality changes, which is the entire point of the document.

The agencies doing this well have made Monitor boring. It is a recurring meeting with a short agenda and an owner. Nothing about it is heroic.

The ones struggling have made it an event, and events get postponed.

One practical starting point if your con-mon exists mainly on paper. Pick the ten controls most likely to drift in your environment and put them on a monthly rotation. Ten reviewed honestly beats two hundred reviewed in name only, and it gives you something real to show when someone asks what your monitoring actually consists of.

09/01/2026

CySA+ or SecurityX. This is one of the more common mid-career questions I get, and people usually ask it the wrong way.

The question is not which one is harder, or which looks better. It is which direction you are actually walking.

Pick CySA+ if your next few years are hands on the keyboard. Detection engineering, threat hunting, incident response, tuning the tools, being the person who works out what actually happened. It is a working analyst's certification and it assumes you want to stay close to the data.

Pick SecurityX if your next few years are decisions. Architecture reviews, risk trade-offs, telling a program manager why a design does not work and what it will cost to fix. It sits at a level where you are expected to weigh options rather than execute a playbook.

Where people go wrong is choosing by prestige. SecurityX is the more advanced credential, so it gets picked by analysts who then discover the exam rewards judgment they have not had the chance to build yet. That is not a knowledge gap you can study away in three weeks. It comes from having been responsible for decisions.

The reverse happens too. Strong architects sometimes grab CySA+ because it is well known, then find it does not speak to the work they are being promoted into.

So here is a blunt test. Do you want to be the person who finds the intrusion, or the person who gets asked why the design allowed it? Both are good careers. They are not the same one, and the certification should match the answer.

If you are genuinely between them, tell me what your last two projects looked like and I will give you a straight recommendation.

08/31/2026

Zero Trust has a purchasing problem.

Agencies are buying it. Budget gets allocated, a tool gets selected, an architecture diagram gets drawn with a vendor logo in the middle, and the maturity score barely moves. Then the next fiscal year somebody asks why.

The reason is that Zero Trust is mostly design work, and design work is hard to put on a contract. The parts that actually change your risk are unglamorous. Knowing every identity in your environment and what it is entitled to. Deciding where your trust boundaries genuinely sit rather than where the network diagram says they do. Segmenting in a way that survives an application team asking for an exception. Instrumenting enough to tell whether a policy is being enforced or quietly bypassed.

None of that arrives in a box. A product can enforce a decision you have already made. It cannot make the decision for you, and it will happily enforce a bad one.

What I see working: teams that treat identity as the first project rather than the third, and that accept a smaller initial scope so the segmentation is real. One enclave done properly teaches you more than an enterprise rollout that stalls at the pilot.

What I see failing: buying capability ahead of clarity, then reverse engineering an architecture to justify the purchase.

The uncomfortable version of this is that the hardest Zero Trust work is organizational. You are asking application owners to accept constraints they have never had. No tool shortens that conversation.

Address

4176 S Plaza Trl Ste 207
Virginia Beach, VA
23452

Opening Hours

Monday 8am - 5pm
Tuesday 8am - 5pm
Wednesday 8am - 5pm
Thursday 8am - 5pm
Friday 8am - 5pm

Telephone

+17572163656

Website

Alerts

Be the first to know and let us send you an email when It Dojo posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The School

Send a message to It Dojo:

Shortcuts

Share

Category