Government IT leaders have been working through digital transformation roadmaps with a key focus on cybersecurity for several years, supported by mandates and volumes of guidelines from the Federal government. While customer experience has not historically been tied to these efforts, the pandemic exposed some issues in government service delivery that have eroded trust in government. The American people expect not only a secure government, but one that also offers a seamless customer experience. Yet, cybersecurity and customer experience have often been approached as separate functions. At the Department of Homeland Security (DHS), however, the two are coming together.
MeriTalk recently sat down with Erin Godinez, director, homeland security solutions, and Dean Irwin, senior director, cybersecurity, at Maximus, to discuss how the department is using technology to drive improvements that are rebuilding trust in government.
MeriTalk: Many people associate DHS with the Transportation Security Administration (TSA) officers at airports, but their interactions with citizens are wide-ranging. What are some of the other public-facing functions that have elevated the need for a secure customer experience at DHS agencies?
Irwin: Many people don’t realize that DHS interacts with the public more than any other government agency. Every day, the U.S. Citizen and Immigration Service (USCIS) welcomes 3,800 new citizens at naturalization ceremonies across the country. Customs and Border Protection (CBP) interacts with 869,000 international travelers. TSA processes 13,665 new TSA Pre Check enrollments and 3,555 renewals. The Federal Emergency Management Agency (FEMA) deploys 5,700 staff to aid in disaster recovery efforts. The Cybersecurity and Infrastructure Security Agency (CISA) manages 100 requests for assistance in response to cyberattacks and threats. To support and improve all of those interactions, the department is establishing a new customer experience directorate that reports to the CIO’s office. With a core mission to protect our nation, the agency truly sits at the intersection of cybersecurity and customer experience.
MeriTalk: In 2021, the White House issued the Executive Order on Improving the Nation’s Cybersecurity (cyber EO). That same year, it issued the Executive Order on Transforming the Federal Customer Experience and Service Delivery to Rebuild Trust in Government (CX EO). How can agencies that interact with the public balance and achieve the two mandates?
Godinez: The mandates in the cyber EO and the CX EO, along with the strategies set forth in the President’s Management Agenda, signify a transformative shift in digital modernization within government. Cybersecurity has emerged as a fundamental catalyst for the development of secure applications while customer experience has become an essential ingredient for ensuring efficient application functionality. When deployed correctly, cybersecurity and customer experience principles balance each other, such as when multi-factor authentication (MFA) provides login security with minimal imposition to users. Both cybersecurity and customer experience are core, interdependent capabilities that must be recognized for their role in building trust in government.
To effectively deploy both, it’s imperative to take a holistic approach to developing technology solutions, where cybersecurity and the public’s experience coexist to meet mission needs. At DHS, they are turning to public-private partnerships to gain insights on unifying cybersecurity and customer experience. Through collaboration with industry leaders, the department aims to leverage industry best practices and expertise to forge the path in delivering a secure customer experience.
MeriTalk: Many interactions with the public take place electronically, so security is paramount. How does DHS ensure its secure networks combat cyberattacks and safeguard vital systems and data while also providing a good customer experience?
Godinez: Agencies are implementing CISA’s secure by design guidance, which calls for building security into the design of IT solutions. With secure by design, security is baked in, not bolted on, at the design and manufacturing level, which creates a model of shared responsibility.
Irwin: DHS is keenly focused on protecting sensitive information, including personal identifiable information, and monitoring for data loss from both external and internal threat actors. It has multiple security operations centers (SOCs) that monitor systems, handle incident response and threat mitigation, meet logging requirements as outlined in OMB’s M-21-31, and engage in threat hunting activities. At TSA, for example, Maximus protects IT networks using our security operations, digital forensics, and malware analysis capabilities. We also monitor systems to prevent loss of citizen and agency data. This in-depth protection is foundational to a good user experience.
MeriTalk: How can technology drive the secure customer experience in government?
Godinez: Trust is an essential element of the customer experience. In the private sector, customers can stop doing business with a company if they have a poor experience. This is not an option with government-offered services where a single, unfortunate encounter can result in a negative perception and general mistrust of the government’s ability to serve citizens. With cybersecurity, a data breach at one agency can undermine the public’s confidence in the government’s ability to safeguard their personal information.
So, it’s imperative that agencies use technology that delivers a seamless and secure customer experience. Through partnerships, government agencies can break down silos between customer experience, service delivery, and cybersecurity to develop systems and applications that provide a positive customer journey. Technology can enable this with user interfaces and human centered design principles that improve information accessibility, online transactions, and benefit delivery.
MeriTalk: Security can be viewed as an impediment to the user experience. For example, some processes can be overly complex or make it difficult for users to access the resources they need. How have agencies overcome this issue?
Irwin: Agencies such as TSA have thousands of employee users spread across the country who need to access secure networks from various endpoints. Enabling this in a safe and seamless way requires zero trust architectures and tools that allow easy and secure access. These could include MFA, push notifications to mobile devices, access cards, and portable hardware tokens. With these tools, agencies can meet cybersecurity mandates while offering a good experience.
They also use security orchestration, automation, and response (SOAR) technology for a proactive approach to cybersecurity. SOAR uses predictive tools that analyze user behavior to spot anomalies and potential threats, which protects users in ways they don’t even see.
MeriTalk: What are some capabilities that Maximus uses to support DHS with customer experience and cybersecurity initiatives?
Godinez: Maximus is tapping into artificial intelligence and natural language understanding to support public sector agencies in improving the digital customer experience through our FedRAMP-authorized Maximus Intelligent Virtual Assistant, or Maximus IVA. The chatbot supports visitors to public sector websites such as USCIS with information and resources 24 hours a day.
Irwin: We also incorporate the information security model known as the CIA triad – confidentiality, integrity, and availability. Through zero trust measures, threat hunting and digital forensics, Maximus helps to secure confidential data against loss and ensures critical applications are available, all while following data compliance requirements.
MeriTalk: What is Maximus’s view of how to bring the benefits of both security and customer experience to the American people?
Godinez: For decades, Maximus has supported Federal agencies with programs that connect with citizens, which gives us a unique perspective. We know the importance of combining cybersecurity technology and human centered design principles to deliver a customer-centric experience with greater security, efficiency, and engagement.
This requires a holistic approach that takes into account all digital and in-person interactions with the public and other stakeholders. Maximus identifies areas where a better customer experience would reduce friction points and uncover cyber vulnerabilities that need to be eliminated. Effective modernization of legacy systems requires this integration of cybersecurity and customer experience.