Smarter Gov Tech, Stronger MerITocracy
This page is not built out yet. If you are seeing this page, please contact an administrator.

The Weekend Reader–Sept. 16

Industry Insider: What’s Happening in IT

meritalk-logoMeriTalk compiles a weekly roundup of contracts and other industry activity. Stay up to date on everything that’s happening in the Federal Information Technology community. MeriTalk.com keeps you informed about the topics that mean the most to you and creates a targeted platform for cooperation, public-private dialogue, highlighting innovation, and sharing informed opinions. This week: Georgia Tech gets a Department of Energy award, and Lockheed Martin gets a DHS contract.

Its Not Clear Where to Go on Election Cybersecurity

meritalk.comThe Technical Guidelines Development Committee’s cybersecurity working group doesn’t know what to focus on in terms of voting security less than two months from Election Day. “Should we try to continue at this stage or should we simply move on?” Wagner asked the committee. The cybersecurity working group identifies election security principals, looks at election use cases, articulates security best practices, and finds and prioritizes risks. “Most of [the systems] we can handle if you tell us to develop specific requirements.” The committee declined to outline specific requirements in case their best practices duplicated other agencies.

 

Internet Domain Name System Will Finally be Privatized

meritalk.comThe National Telecommunications and Information Administration on Oct. 1 will finish the process of privatizing the Internet’s address book, a task it started in the 1990s. The DNS creates and stores the names of Internet sites. The Federal government has no statutory authority over ICANN. Shifting control to the U.N.–or any intergovernmental body–would leave the Internet vulnerable to geopolitical disputes and endless bureaucratic delays.

 

 

 

The Situation Report: Separating the FedRAMP Signal From the Noise

meritalk.com

The storm has not yet passed for some big programs run by the General Services Administration. During a joint forum hosted by GSA and MeriTalk, GSA’s chief information officer, David Shive, responded honestly and without hesitation to some tough questions on a number of fronts, including the Federal Risk and Authorization Management Program’s (FedRAMP) spending of $150,000 in taxpayer money to duplicate an online dashboard capability that had already been developed in the private sector and made available to the government for free. Questions were also raised about financial management problems at GSA’s internal tech consulting organization, 18F. Sources tell The Situation Report that the IG wants to know why the agency’s digital services consultants can’t explain how they used about $200,000 worth of seed funding. Interestingly, SitRep sources reported the presence of four members of the GSA inspector general’s office in the audience Tuesday.

 

Senate Prepares to Modernize 911 Services

meritalk.comThe Senate Committee on Commerce, Science, and Transportation will introduce legislation that aims to fund and expand 911 emergency services at the insistence of the Federal Communications Commission (FCC). 911 emergency networks are dangerously out of date, according to FCC Chairman Tom Wheeler. He said it is time for Congress to transition to the Next Generation 911 (NG911) first envisioned in 1999. Wheeler said the quality of 911 support will deteriorate if Congress does not apply NG911 on a large scale.

 

The Situation Report: Separating the FedRAMP Signal From the Noise

My mobile listening post parked outside the Newseum in downtown Washington, D.C., picked up some crystal clear signals Tuesday that the storm has not yet passed for some big programs run by the General Services Administration.

During a joint forum hosted by GSA and MeriTalk, GSA’s chief information officer, David Shive, responded honestly and without hesitation to some tough questions on a number of fronts, including the Federal Risk and Authorization Management Program’s (FedRAMP) spending of $150,000 in taxpayer money to duplicate an online dashboard capability that had already been developed in the private sector and made available to the government for free.

Questions were also raised about financial management problems at GSA’s internal tech consulting organization, 18F. Sources tell The Situation Report that the IG wants to know why the agency’s digital services consultants can’t explain how they used about $200,000 worth of seed funding.

“I invite those comments. I invite this dialogue,” said Shive. “Without this conversation we can’t get better.”

Matt Goodrich, the director of the FedRAMP Program Management Office, on Wednesday chose to characterize the legitimate questioning of FedRAMP reform efforts to date as “noise” and “antics.”

goodrich tweet

The Situation Report, however, has picked up strong indicators that what Goodrich wants taxpayers to view as noise and antics will actually be documented in early October in a major GSA inspector general report covering a wide range of business, financial management, and technology issues. Interestingly, SitRep sources reported the presence of four members of the GSA inspector general’s office in the audience Tuesday.

It will be interesting to see how the October IG report influences potential actions on Capitol Hill to ensure the FedRAMP authorization process lives up to its original intent—certify once, use many.

“This process has now become an extra layer and burden for industry,” said Rep. Gerry Connolly, D-Va. “[Congress] will absolutely insist that it be a one-step process, not a two-step. Either JAB [Joint Authorization Board] certifies and that’s good enough for everybody, or you go to a system where you’ve got to go to each individual agency, and I predict Congress will go for the former.”

OverHURD on the Hill

My remote sensors on Capitol Hill have discovered more movement on the IT modernization front by Rep. Will Hurd, R-Texas. The chairman of the House IT Subcommittee has drafted and is prepared to drop a new bill that will combine aspects of his MOVE IT legislation (which calls for working capital funds at the 24 CFO Act agencies) with the IT Modernization Act proposed by Rep. Steny Hoyer, D-Md., which would establish a mega fund at GSA (including an investment review board) into a comprehensive IT modernization package.

One of my agents reports that the new bill will be called the Modernizing Government Technology Act or MGT. But Hurd originally wanted to call it MOVE IT 2.0. Apparently, Congress doesn’t allow software-esque version designations on proposed tech bills.

Sources tell The SitRep that the House Oversight and Government Reform Committee plans to mark up the bill Thursday and is expected to be considered by the full House of Representatives on Sept. 19.

Sources close to the process on the Hill said the bill could be “hotlined” and considered by unanimous consent by the Senate prior to the upcoming recess.

Share your Situation Reports at dverton@meritalk.com or follow me on Twitter

Why are Federal Agencies so Afraid to Jettison Old IT?

“It is not the strongest or the most intelligent who will survive but those who can best manage change.”  – Charles Darwin

The U.S. Federal government and its agencies all agree on the need to modernize IT infrastructure, though they continue to struggle with just how to do it. Industry analysts have said over and over again that an organization can actually reduce their costs for maintenance, increase agility by automating processes, and get more compute performance per square foot. Budgets are always constrained, and they have been for many years. But by spending a little bit now your agency can begin to see an actual return on its investment in as little as 18 months.

The term “digital transformation” is used in this context, but it’s so much more than simply digitizing IT. Digital transformation is changing human society. “Transformation” in an organization occurs when digital technologies and innovation are applied to traditional methods, or replace them altogether.

So beyond the obvious reasons, why do Federal agencies continue to hang on to old, underperforming, manually managed technology? It seems crazy, right? In today’s digital world, you and your agency can either change or be changed. And it’s the laggards that experience significant–and sometimes fatal–consequences.

The conversation starts with this question: Does your agency view IT as something that runs things or a tool that changes things? Laggards usually see IT as a tool and a cost center that runs mission-critical functions. But future-ready agencies view IT as an engine of value creation. They see the opportunity to run processes more efficiently so they can become leaner and faster. Federal CIOs give their organization the insights necessary to make better decisions and engage with their constituents not only more efficiently but also more deeply.

So why are Federal agencies so afraid to jettison old IT?

Fear of disruption or change: Let’s face it, any change involves some risk. But the reward can be more than worth it. McKinsey & Company recently reported that digital transformation can boost an organization’s bottom line by more than 50 percent over five years if they pull all levers.

 Perceived lack of budget/resources: If IT is perceived as a cost center then you’ll never get enough budget and resources. Once IT becomes a value center–an engine of efficiency and agility–modernization will pay for itself. In March 2016, for example, a Government Accountability Office report revealed that the Departments of Commerce, Defense, Homeland Security, and Treasury saved $2.8 billion by participating in the Federal Data Center Consolidation Initiative.

 Not empowered to lead change: The success of an organization is everyone’s job. But there is good news and bad news here. A recent study by Red Hat and Harvard University showed that CIOs believe CEOs for the most part “get it.” Sixty-nine percent of those surveyed said their CEO understands digital opportunities and threats. The bad news is that less than one quarter of business leaders believe the CIO is adequately preparing their organization for a digital technology-driven future. On the Federal side, efforts like the Federal Information Technology Acquisition Reform Act (FITARA), the CIO is officially empowered to lead an agency’s digital transformation. It is job No. 1 for IT leaders to change that perception and take bold action by aligning the priorities of IT with those of the organization.

Difficulty of selling the concept and cost of change: IT leaders haven’t traditionally been salespeople. But change requires some serious selling skills to show the direct connection between agency efficiency and technology, and to drive agreement on a mission and vision for IT infrastructure. Everyone’s goal is to propel their agency into the future, to thrive, not just survive. So take advantage of the resources provided by your IT vendor to sell cost savings to agency leadership.

Take action and drive change. Learn about cloud-based solutions that drive innovation, and endpoint strategies that can increase productivity. Register today for the Federal sessions at Dell EMC World Oct. 18-20 in Austin, Texas. Registration is free for U.S. government employees.

So the question is, are you future ready?

The Weekend Reader–Sept. 9

Industry Insider: What’s Happening in IT

meritalk-logoMeriTalk compiles a weekly roundup of contracts and other industry activity. Stay up to date on everything that’s happening in the Federal Information Technology community. MeriTalk.com keeps you informed about the topics that mean the most to you and creates a targeted platform for cooperation, public-private dialogue, highlighting innovation, and sharing informed opinions. This week: Intel will acquire Movidius,  and Tetra Tech gets a NOAA contract.

DHS Gregory Touhill Becomes First Federal Chief Information Security Officer

meritalk.comThe White House on Thursday named Brig. Gen. (Ret.) Gregory Touhill as the Federal government’s first chief information security officer, bringing to a close an executive search that has gone on for more than seven months. “In creating the CISO role, and looking at successful organizational models across government, it became apparent that having a career role partnered with a senior official is not only the norm but also provides needed continuity over time,” U.S. CIO Tony Scott said. Touhill enters the job less than four months before the Obama administration leaves office and a new administration is likely to shuffle most of the top national security leadership posts.

 

Maryland Tops the List of Best State Government Websites

meritalk.comFor the first time in state history, Maryland’s state government website was named the best in the country by the Center for Digital Government’s Best of Web  competition. “From day one, our administration has been committed to providing Marylanders with the highest level of customer service across every platform, from in-person to electronic interactions,” said Gov. Larry Hogan. Residents are also able to pay for various government fees online and find information on upcoming events sponsored by the state government.

 

Look Out, Barbie: Ransomwares Next Step is Mobile, IoT Devices

meritalk.comSince 2013, more mobile devices have been sold than laptops. Therefore, ransomware is progressing from laptops to mobile devices and IoT devices. Mobile ransomware hackers could use their skills to change the PIN on a user’s phone, overlay an app on an entire phone screen so that the user can’t do anything else on their cellphone, or use the camera app to take pictures or video of the user and threaten to upload the recordings to the cloud.

 

Chaffetz Critiques OPM Cyber and Calls for Zero Trust Policies

meritalk.comAgencies should be implementing a policy of zero trust when it comes to who is accessing their data, according to Rep. Jason Chaffetz, R-Utah. “Zero trust is one of the things I like to think the private sector figured out a long time ago,” said Chaffetz. Zero trust operates under the principle of “never trust, always verify,” which means that trust is never assumed for any device or user on the system. Chaffetz said the policy is like requiring elementary school students to carry hall passes when they leave the classroom.

 

How FITARA Supports Cybersecurity Efforts

FITARA addresses the following four areas: Incremental development, risk assessment transparency, IT portfolio review savings, and data center consolidation. How do these areas support cybersecurity actions?

The Situation Report: What is a Federal CISO Worth?

Are you wondering what happened to the big Federal chief information security officer announcement that your humble correspondent and just about every other tech media outlet said back in June was imminent? Truth be told, so am I.

(Update: Less than 24 hours after this installment of The Situation Report hit the presses, U.S. Chief Information Officer Tony Scott announced Gregory Touhill had been named to the Federal CISO post—exactly 212 days after the search began.)

But The Situation Report has the benefit of an intelligence collection network that is reporting some interesting twists and turns in the White House’s search for the government’s first Federal CISO.

First, the title Federal CISO sounds like it will pack a lot of punch, doesn’t it? Well, that may be true, but my Oval Office listening post is reporting that the job will almost certainly not punch the authority or salary that the most qualified candidates will expect.

Several agency CISOs, who spoke to The Situation Report on condition of anonymity, openly scoffed at the mere mention of the position. “The last thing I need is another boss,” said one CISO, referencing the many layers of oversight at both the agency and congressional levels that must be managed.

The Situation Report also received interesting intelligence on the massive salary discrepancy between the Federal CISO job (with all of its trappings of national responsibility and the likelihood of having one’s head put on a platter) and CISO jobs of similar stature in the private sector.

The high end of the Federal CISO’s earning potential is a mere $185,000 per year. One of the leading candidates for the job is already at that earnings level for senior executives. The other major candidate, which The Situation Report is keeping under wraps given the sensitive nature of the discussions, would fall right in the sweet spot in terms of salary but doesn’t bring nearly enough experience or name recognition to the table.

The average salary of the top seven Federal CISOs capable of doing the job (or under active consideration) is $162,534 per year. The average private sector CISO position pays $224,000 per year, according to IT and cybersecurity recruiting firm SilverBull. And if you really have the chops, you might land a gig on the high end of private sector CISO earnings potential—$346,000 per year—and you could find yourself starting work in about 47 days. By comparison, as of this writing the Federal CISO job has been open for 211 days.

But the hits just keep on coming. Let’s say you’re a government CISO in Washington, D.C. You’ve laid down some roots in the area and, alas, the new Federal CISO gig looks like it’s not going to happen for you, or, worse, the offer lands in your inbox less than three months before the new president-elect gets to name his or her new team. Fear not, there are a few dozen senior CISO jobs open in the National Capitol Region and the better ones can land you up to $379,000 a year.

Tired of the back-stabbing wonks of Washington? Head West young man, or woman. San Francisco has some CISO gigs open at an average salary of $278,000 per year. Maybe you will land that diamond in the rough at $430,000 per year.

Yes, these are some outrageous numbers for most government IT professionals—especially those who do the real work, out of the spotlight, because of a desire to serve. But let’s face it: Any reasonable security professional looking at the current situation with the Federal CISO position has serious questions, I’m sure. Like, what authority will I have? What will happen to my career if I’m at the helm for a mere three months, only to have another major data breach occur?

I look at the earnings data, I read these questions, and I hear San Francisco calling.

Got a Situation to Report? Send it to dverton@meritalk.com

The Weekend Reader–Sept. 2

What’s Happening in IT

meritalk-logoMeriTalk begins a weekly roundup of contracts and other industry activity. Stay up to date on everything that’s happening in the Federal Information Technology community. MeriTalk.com keeps you informed about the topics that mean the most to you and creates a targeted platform for cooperation, public-private dialogue, highlighting innovation, and sharing informed opinions. This week: NASA, the Department of Defense, and the National Geospatial-Intelligence Agency all awarded contracts, and Avaya makes some personnel moves.

 

Exclusive: Hurd’s MOVE IT Act Gaining Steam on Hill

meritalk.com

Democratic and Republican policy advisers in the House are meeting to craft a bipartisan compromise that would combine the key elements of two major IT modernization bills introduced earlier this year into a legislative package that sources say has the backing of Republican appropriators and stands a good chance of being signed into law before President Barack Obama leaves office. The negotiations are focused on integrating select components of Rep. Steny Hoyer’s, D-Md., IT Modernization Act into the Modernizing Outdated and Vulnerable Equipment and Information Technology (MOVE IT) Act, introduced by Rep. Will Hurd, R-Texas, MeriTalk has learned.

5 Ways the Government Can Foster IoT

meritalk.com

As the Internet of Things becomes increasingly prevalent, the government will play an important role in enabling and regulating how the industry will develop, according to panelists at a National Telecommunications and Information Administration workshop. “Developers need advice now,” said Craig Spiezle, executive director, founder, and president of the Online Trust Alliance. He and other panelists listed a number of areas in which that advice can take shape. Many panelists pointed to current Federal policies and legislation that can stand as a starting point for government treatment of IoT. The 1997 framework puts the private sector in the lead and, only when needed, calls for the government to intervene with a simple, predictable legal framework.

 

Students Compete in FBI Online Safety Challenge

meritalk.comSince 2012, teachers in grades 3-8 have signed up more than 870,000 students to participate in the national competition. The website has one island per grade level where students play age-appropriate games to learn about Internet safety. After navigating through the islands, students take a quiz based on the topics they learned.

 

 

Smart Pill, Sepsis Chip Named Winners in NIH DEBUT Challenge

meritalk.comThe National Institutes of Health announced the winners of the Design by Biomedical Undergraduate Teams Challenge, which included designs for smart pills and disposable sepsis detection chips.Winners excelled across six key categories. The first-place team, from Purdue University, created a “smart pill” to diagnose tuberculosis in children. TB diagnosis is a challenge in low-resources areas because they require trained clinicians and stable electricity–and for children, pediatric diagnostic tests are invasive and painful. The second-place team, from University of Illinois at Urbana-Champaign, developed a disposable sepsis detection chip.

 

Building a Cloud-Ready Federal IT Workforce

As agencies navigate cloud, they continue to leverage and build upon lessons learned.  And, it seems to be working:  According to a recent MeriTalk study, 75% of Federal cloud decision-makers say their workforce is somewhat or very comfortable with moving its systems to the cloud.

But, how did they get there and what’s really the first step of a successful migration?  Knowing your IT environment is important – but even more essential is ensuring you have a cloud-ready workforce.

Rally the Troops

Bring in infrastructure experts early.  These individuals will help you get a better sense for your IT environment – and advise your agency on what future application development and planning should look like.

Plus – there is a lot of expertise in the data center when it comes to knowing your agency’s applications and systems in its database.  Tap into such and ensure infrastructure experts are taking advantage of the heart of your network.

Quality Over Quantity

In addition to infrastructure experts, good systems/network administrators are vital to determining your current and future IT environment – both wants and needs.  They can look at your agency’s applications and determine how much capacity is being consumed and what type of resources work best, in addition to other factors you may overlook.

Approaching the Front Line

Get your public/private partnerships involved in your cloud transition.  For example, financial personnel – from controllers to analysts – will understand the impact of your cloud choice:  what’s the price?  How do I consume it – and what does it look like if I’m operating under the traditional construct?

And, with increasingly ambiguous language found in cloud contracts, it is beneficial, and even recommended, to seek outside help from a lawyer well-versed in cloud computing contracts.  In fact, cloud service providers (CSPs), customers, and end-users should all be involved in contract negotiations, with everyone’s expectations and requirements captured in the final agreement.

A United Front

At the end of the day, even the best cloud model cannot yield optimal value without the right team to handle it.  Pulling together a team of experts – and providing cloud guidance along the way – ensures your workforce is cloud-ready.

As the number of cloud success stories continues to rise, CSPs are more prepared to guide your agency through its own process.  From a business model approach and flex cloud model, to 24/7/265 enterprise class support and professional/managed services, CSPs are on standby, ready to help your agency navigate the cloudy skies.

And that’s the real silver lining.

Learn how you can build your cloud strategy with confidence.

The Situation Report: Comey’s Encryption Comeback

Your humble correspondent got a chance to ask FBI Director James Comey about his views on the recent hacking attempts against election systems in Arizona and Illinois. But his answer to my question at the 13th Annual Symantec Government Symposium paled in comparison to his renewed counterattack against Silicon Valley’s stance on ubiquitous encryption.

Comey expressed serious concerns about large swaths of the Internet “going dark,” becoming effectively out of reach of legitimate law enforcement and national security investigations. We should all be concerned about that. But Comey may have reignited the war of words with Silicon Valley when he basically told the tech industry’s giants that it’s not their place to decide national policy that would fundamentally alter the privacy bargain that has been at the heart of democracy in America since its founding.

“The FBI’s role is not to tell the American people how to live and how to govern themselves,” Comey said. “And it’s also not the job of tech companies, as wonderful as they are, as great as their stuff is, to tell the American people how to live, how to govern themselves. Their job is to innovate and sell us great equipment. The American people should decide: How do we want to live? How do we want to be governed? How do we want to govern ourselves?”

That was an astonishing rebuke of Apple CEO Tim Cook and other Silicon Valley high priests who signed an open letter in April to the Senate Select Committee on Intelligence calling for an end to government mandates that would grant access to encryption keys for law enforcement and national security purposes.

Comey accused the tech industry of attempting to force a policy upon the nation that would fundamentally alter the “reasonable expectation of privacy” bargain struck between the government and the governed.

Former DHS Chief Privacy Officer Nuala O'Connor said FBI Director James Comey "could not be more wrong on encryption." (Photo: Dan Verton)
Former DHS Chief Privacy Officer Nuala O’Connor said FBI Director James Comey “could not be more wrong on encryption.” (Photo: Dan Verton)

“Even our memories are not absolutely private in the Unites States,” Comey said. “Even our communications with our spouses, with our lawyers, with our clergy, with our medical professionals are not absolutely private. Because a judge, under certain circumstances, can order all of us to testify about what we saw, remembered, or heard. There are really important constraints on that. But the general principle is one that we’ve always accepted in the United States and has been at the core of our country: There is no such thing as absolute privacy in America. There is no place outside of judicial authority.”

And when it comes to the issue of encryption? “Widespread default encryption changes that bargain. In my view it actually changes the bargain at the center of our country,” said Comey.

For Comey, that bargain is based on Americans’ reasonable expectation of privacy “in our houses, in our cars, in our safe deposit boxes, in our devices.” The government cannot invade our private spaces without good reason, good reason that is subject to court approval, he said. “But it also means that with good reason the people of the United States, through judges and law enforcement, can invade our public spaces. That is the bargain that has been at the heart of the liberty of this country since its founding.”

Shortly after Comey’s presentation, I asked Nuala O’Connor, the president and CEO of the Center for Democracy & Technology (CDT) and the first Federal chief privacy officer at the Department of Homeland Security, what she thought of Comey doubling down on his encryption stance.

O’Connor, who knows and admires Comey, offered a simple counterargument: “He could not be more wrong on encryption.”

 

The Weekend Reader-Aug. 26

Energy Sector Cybersecurity Called the Backbone of All Critical Infrastructure

meritalk.com

The interconnectedness of the energy sector presents both increased challenges and potential, according to panelists at an Institute for Critical Infrastructure Technology briefing. “The energy sector is clearly the backbone of all 16 critical infrastructures,” said Jay Williams, an ICIT fellow and vice president of cyber infrastructure protection at Parsons. “Cybersecurity needs to be part of the culture in all 16 critical infrastructures.” Panelists agreed that one of the major ways to protect the energy sector against the almost inevitable cyberattack is to share information about attackers and cybersecurity practices more freely.

 

E-Rate Doesnt Improve Learning, Study Says

meritalk.comThe E-Rate program, which has provided $25 billion in subsidies since 1996 to schools from the Federal government for broadband, internal wiring, and networking equipment, hasn’t correlated with increased test scores among students in North Carolina, a recent study says. The researchers studied how E-rate affected the number of students per Internet-connected computer, SAT scores, and how dollars per student affect test scores from 1999-2013 in public high schools. Under E-rate, schools could apply for grants from the government that would give them a 20 percent to 90 percent discount on telecommunications services and costs associated with Internet wiring, depending on the school’s needs.

 

Agency Cloud Adoption Moves Quickly, Considering Obstacles

meritalk.comIn the five years since the government has encouraged agencies to transition to the cloud, spending on cloud-based technologies has increased to about 9 percent, which is a good pace, according to Tom Ruff, vice president of Public Sector America at Akamai. “That was a pretty nice jump given that cloud had some obstacles to begin with,” Ruff said. Agencies struggle with transitioning to the cloud because of security and control concerns.

 

The Situation Report: Pentagon Evolves Identity Management

meritalk.comMany of you have heard of “joint operations,” “information operations,” and “intelligence collection activities” when it comes to the world of defense and national security. Well, let me introduce you to the Pentagon’s latest buzz phrase–Identity Activities. “Identity is the summary (or sum total) of multiple aspects of an entity’s characteristics, attributes, activities, reputation, knowledge, and judgments–all of which are constantly evolving,” according to the new guidance.

 

Department of Education Delivers Death Blow to ITT Tech

meritalk.com

The U.S. Department of Education issued what analysts are calling a death sentence for ITT Technical Institute. As part of a larger series of restrictions on the for-profit higher education institution, the Department of Education has banned ITT from accepting new students who depend on Federal student aid,  which is the source of most of ITT’s revenue. The school is also required to warn current students that its accreditation is in jeopardy.  ITT must inform the department of any significant financial or oversight events including violations of existing loan agreements or extraordinary financial losses within 10 days of such events.

 

Federal Cloud: What Are Agencies Learning?

We don’t need a crystal ball to know the future is bright for Federal cloud.  While agencies are starting to embrace cloud – today, 85% of Federal cloud decision-makers are more optimistic about what cloud can do for their agency than they were five years ago – think we can all agree the Federal IT community is still in the cloud learning curve.  Looking at efforts to date, what have agencies learned?

Planning Counts.  So Does Flexibility. 

What is the common characteristic among agencies that have had cloud success?  Strategy.  Not only do they have a strategy, but they implement it as well – and are not afraid to change plans, if needed.

These cloud pioneers have considered the best cloud model for their agency and also planned the migration using various methodologies – for example, a methodology that includes agile application development for cloud.

They’ve also reached out to their CIO peers to learn implementation best practices – tips and tricks of the trade.  While one agency’s approach may not be a perfect fit for the next, every agency can learn from each other’s efforts – in both areas of success and improvement.

Know What’s Under the Covers.

Looking at the cloud planning process today vs. a few years ago, most agencies have a better appreciation of understanding the importance of the IT environment.  Know your applications; what workloads are where – what is in mainframes, what is virtualized; and which applications will be easiest to move.  Apps developed more recently in a virtualized environment will be better candidates for cloud migration than older applications hard-coded in a mainframe environment.

IT Takes a Village. 

Traditional IT models have led to silos of expertise – infrastructure, applications, networking, and finance.  For cloud success, everyone needs cloud education.  More often than not, the finance team is brought on too late in the process.  This increases the probability of a budget speed bump.   Successful cloud leaders pull the team together and focus on growing cloud expertise before they begin the migration process.  Better education leads to better decisions.

Don’t Go It Alone.

A 2014 MeriTalk cloud report (“Cloud Control: Moving to the Comfort Zone”) asked Fed IT decision-makers if they were comfortable handing their migration process over to CSPs – and only 44% said yes.  Today, 79% of Feds are comfortable turning their data over to a trusted CSP.

Why the change of heart?  Assessing cloud complexities requires extensive knowledge on a variety of fronts.  CSPs and cloud partners bring the experience – and accompanying knowledge – of multiple implementations, helping agencies understand all facets:  How it works, how to buy it, how to run it, and how to resource it.  Leveraging private partners also helps ensure your agency considers the most up-to-date cloud options.

Private, Public, or Hybrid?  The Option is Yours. 

There are pros and cons to all cloud models.  The key to figuring out which works best for your agency begins with a foundational assessment before you make your cloud selection.  Agencies with the most cloud success are the ones who understand their environment: current and future needs, their budget constraints, their team, and their risk profile – capital, operational, budgetary.

Private cloud options provide agencies with the security they seek, while public cloud provides versatility.  And, agencies can now gain the benefits of both through a hybrid cloud model.

Cloud Success:  Step by Step

Start small, select the right applications to move, and seek out cloud lessons from the public and private sector.   Have a plan, but stay flexible.

The good news is that there are many cloud success stories and many more resources available than there were just a few years ago – helping to build cloud knowledge and ease cloud transitions.

And that’s the real silver lining.

Learn more about how the business of cloud can help your agency build its dream Federal cloud.

This blog post was originally published here

The Situation Report: Pentagon Evolves Identity Management

You use a fingerprint to access your smartphone, an access card to enter your place of work, and the last four digits of your Social Security number to verify you are who you say you are. But can any of these things really determine your identity?

Not really, according to a new Defense Department guidance document. Many of you have heard of “joint operations,” “information operations,” and “intelligence collection activities” when it comes to the world of defense and national security. Well, let me introduce you to the Pentagon’s latest buzz phrase–Identity Activities.

“Identity is the summary (or sum total) of multiple aspects of an entity’s characteristics, attributes, activities, reputation, knowledge, and judgments–all of which are constantly evolving,” according to the new guidance. “Identity is the sum of gathered descriptors and assertions and not simply a physical or current manifestation of limited attributes.”

situation report logoWhat does all of this psychobabble really mean? Well, it means the Pentagon wants to employ data analysis tools that will leverage biographical, biological, behavioral, and reputational data inputs to help the military determine the identity of a person they encounter on the battlefield and whether that person poses any kind of threat.

So what data elements would actually feed such an identity system? Here’s what the Defense Department says:

Biographical: Name, address, passport number, tax records, etc….

Biological: Fingerprints, facial images, iris images, DNA, etc….

Behavioral: Cellphone records, social media, travel patterns, etc….

Reputational: Statements attesting or vouching for character, criminal  records,  credit  scores,  security  clearances, organizational  position, etc….

But that summary is really just the tip of the identity iceberg. According to DoD, “approximately 500 separate data types and subtypes of identity attributes that support relevant national security activities have been identified.”

dod identity

Second only to the expanded categories and subcategories of identity attributes is the number of databases maintained at the Federal level that are dedicated to one or more methods of tracking identities.

  1. DOD Automated Biometric Identification System (ABIS).
  2. National DNA Index System (NDIS) and Joint Federal Agencies Intelligence DNA Database (JFAIDD).
  3. Biometric Identity Intelligence Resource (BI2R).
  4. Harmony.
  5. Detainee Reporting System (DRS).
  6. FBI’s Next Generation Identification (NGI).
  7. Department of Homeland Security (DHS) Automated Biometric Identification System (IDENT).
  8. DHS TECS.
  9. Terrorist Identities Datamart Environment (TIDE).

Cloud Control: How Can CIOs Stay in the Driver’s Seat?

Agencies are moving users to the cloud, but how can they streamline the process? How can it be simplified to create an enhanced user experience?

“What activities, what data, and what threat are they bringing into the cloud?” These three questions are identified as primary concepts agencies should use to assess and prevent cloud application use as necessary, then implement policies based on the answers.

How and Where to Get Started to Respond to the MEGABYTE Act

Everybody likes to exercise their frugal muscles and negotiation skills when shopping for the best deal they can get on an expensive item. Sometimes they belong to a buying consortium that has already done the legwork to negotiate the lowest price, and that pre-negotiated low price makes it seem as if the hard part is over.

In reality, that is just the beginning of the process when purchasing software. The hard part occurs after the purchase, when you need to confirm you’re getting the expected value and return on investment from that software. Determining that requires life cycle planning, even before the purchase is made. Life cycle planning includes having a strategy that looks holistically at the software from purchase to install to retirement, many years later.

To ensure agency CIOs are keeping an eye on their IT software spending, the MEGABYTE Act, which is short for Making Electronic Government Accountable By Yielding Tangible Efficiencies Act, was passed in July 2016. This Act is a follow on to the Federal Information Technology Acquisition Reform Act (FITARA) and the National Defense Authorization Act for Fiscal Year 2015 (NDAAFY2015). These previous laws were intended to be a comprehensive guide to prevent IT waste and mismanagement, but more detail was needed to support software purchases, which represented $9 billion in 2015, according to OMB.

The MEGABYTE Act follows on the 2015 legislation by mandating that agency CIOs adhere to the outlined six areas of focus that are designed to provide more visibility into purchased software and drive efficiencies. Here’s a quick summary of the six provisions:

  • Establish a comprehensive inventory.
  • Implement a life cycle approach to software license management.
  • Analyze software usage and other data to make cost effective decisions.
  • Provide training relevant to software license management.
  • Establish goals and objectives for software license management program.
  • Consider the software license management life cycle phases (including requisition, reception, deployment and maintenance, retirement, and disposal phases) to implement effective decision-making and incorporate existing standards, processes and metrics.

To prepare for this legislation, agency CIOs should begin by conducting an assessment of their current discovery and inventory tools. Many times agencies will have multiple tools in place and they’ll try to leverage existing tools designed for security or network monitoring. These tools are great at discovering IP-connected devices; however, inventorying and being to identify the installed software may not be a strength. By ensuring that the tool is fit for its purpose will be foundational to successful reporting. Without robust software usage monitoring and comprehensive software knowledge base, it will be difficult to achieve the timelines outlined in the legislation.

The next step is to confirm that the discovery tool is fully deployed. Many times there are so many tools that there isn’t a standard discovery tool or one that is rolled out to every endpoint. If the discovery tools can’t go cross-platform, such as inventory mainframe z/OS, look for an alternative tool. If there isn’t enough budget or mainframes to justify purchasing a platform-specific tool, consider allocating headcount or leveraging existing headcount to conduct inventory.

After the foundational discovery tool is in place, determine what needs to be measured and tracked. When it comes to software there are basic and more advanced metrics that reflect what is happening in the environment. For agencies just starting out, we recommend using the basic metrics around install and usage.

Most private sector organizations monitor software application usage on a quarterly basis to detect which applications a user has opened and closed. For expensive applications, they may decide to go to a more granular level and detect keyboard activity. Other metrics might include software that has been purchased but never deployed because funding or resources for the project were discontinued, or software that has been purchased and deployed but is no longer needed. Starting with these metrics will begin to identify opportunities where costs can be avoided or savings from discontinuing maintenance for unused applications can be gained.

In theory, implementing a software life cycle approach isn’t difficult. However, where there are a lot of legacy applications, a complex decision process requiring risk management analysis will be needed. A team of IT professionals with experience with not only tools, but also with procurement, sourcing, contracts, project and portfolio management, vendor management, performance scorecards, and enterprise architecture are needed to provide feedback into life cycle planning. CIOs should evaluate staff to determine if existing employees have the skillsets needed to meet these objectives and consider additional training where necessary.

The potential savings from an effective ITAM/SAM program in a government agency that already has some best practices in place could still be up to 20 percent of the management costs associated with the various assets in the first year of implementation. I’ve often seen ITAM/SAM programs generate enough savings to be self-funded, which frees up funds that can be allocated back to technology investment. With the proper processes, policies, and people in place, CIOs should have no problem reporting their cost savings and risk avoidance from improved software license management practices on a regular basis.

The Weekend Reader-Aug. 19

Data Center Closures and Cloud Key to Pentagons Future IT Environment

meritalk.comIf the Department of Defense were a private corporation, it would sit at the top of the Fortune 100, a behemoth with more than 2 million employees spread across 5,000 locations and a $36 billion annual IT budget. But it would still be wrestling with what is arguably the most complex enterprise network environment in the world. That is the underlying message in the Defense Department’s new strategy document outlining the department’s vision for its future IT environment. Speaking to reporters, CIO Terry Halvorsen characterized the plan as “a living document” that will change as the department and the technology environment change.

 

‘Stranger Things’ Villain DOE Sets the Record Straight

meritalk.comNetflix’s new sci-fi series “Stranger Things” has gripped people everywhere, from comic book nerds to those who yearn to go back to the 1980s. As Will’s friends and family members launch a frenzied search for him, their investigation leads them to the nearby Department of Energy facility. Paul Lester, digital content specialist of DOE’s Office of Public Affairs, binge-watched all eight episodes of the first season in a weekend. He wrote a blog post  addressing the show’s depiction of the agency.

 

 

With FedRAMP Authorization, collab9 Offers Flexibility

meritalk.comThe UCaaS provides services such as unified messaging, video calls, call center functionality, and E911 on the cloud, all of which come from Cisco off-the-shelf software. In an interview with MeriTalk, CEO Kevin Schatzle and Mustafa Baig, head of engineering at collab9, described a couple of areas in which collab9’s recently authorized service provides flexibility: bring your own device and contract vehicles. This means that the security for desktops, laptops, smartphones, and other devices already in use in different agencies can be integrated into the cloud-based communication system.

 

White House Promotes Active Learning

meritalk.comActive learning includes scientific research or software design to supplement subject matter, computer activities that promote trial-and-error learning, collaboration among students, and writing to produce original ideas and understand concepts. “Throughout the Obama administration the president has recognized that engaging and educating more students in science, technology, engineering, and math subjects will meet a growing need in the nation’s high-tech economy and prepare young people for a range of rewarding careers,” wrote Jo Handelsman, associate director for Science in the OSTP, and Quincy Brown, senior policy adviser for the OSTP, in a blog post. The OSTP wants to hear about incentives given to PK-12 teachers for using active learning methods, investments in professional development opportunities for teachers, and training resources that encourage teachers to use active learning strategies.

FRA Issues Grants to Prevent Train Collisions

meritalk.comThe Federal Railroad Administration awarded $25 million in grants Tuesday to 11 companies to develop software that will help prevent train collisions. Railroads will use these grants to achieve interoperability through Positive Train Control systems that work to prevent crashes, derailments, intrusions into work zones, and improper switching of lines. “Every dollar we invest in implementing Positive Train Control as quickly as possible is money well spent because ultimately it means fewer accidents and fewer fatalities,” said Sarah E. Feinberg, administrator for the FRA.

 

The Situation Report: The Driving Forces Behind NSA’s Reorganization

The National Security Agency has operated for decades under a well-defined mission: conduct foreign signals intelligence, support military operations, and defend national security systems from attacks. But major changes in the cyber threat landscape during the last few years have forced the agency to embrace a new reorganization strategy that officials argue is urgently needed to defend the nation from an onslaught of state-sponsored hacking attacks.

“We’re increasingly being called to defend the whole of government,” said Curtis W. Dukes, NSA’s information assurance director, during an invitation-only gathering Tuesday of reporters in Washington, D.C. The number of incidents requiring interagency support from NSA’s information assurance directorate—known inside the agency as a Request for Technical situation report logoServices—has increased significantly during the last two years, Dukes said.

“In the last 24 months, there has not been one incident where we did not augment or support” the Department of Homeland Security and Federal contractors doing incident response work, he said. The most notable incidents include the massive data breach at the Office of Personnel Management, the infiltration of the State Department’s email system, an intrusion into unclassified systems used by the Executive Office of the President, a spearphishing attack targeting the Pentagon’s Joint Staff, and the targeting of Sony Pictures Entertainment by North Korean government hackers.

But one of the most damaging attacks involved the likely theft of blueprints to the Pentagon’s newest high-tech jet fighter, the F-35 Joint Strike Fighter. According to Dukes, all indications lead to China, especially since the Chinese military has since fielded a new jet that looks almost identical to the F-35. “We believe [it’s similar] because they actually stole the blueprints,” Dukes said.

NSA21

Long known as the preeminent signals intelligence collection agency in the world, the NSA’s information assurance mission has grown considerably. The foundation of that mission remains blue teaming–defending national security systems; red teaming–hacking systems to find vulnerabilities before adversaries can take advantage of them; and actively hunting for adversaries on national security networks. Put another way, the information assurance mission is to protect, advise, and support.

NSA21-LogoThat mission is not changing, but the way NSA organizes and operates is. Announced in February by NSA Director Adm. Mike Rogers, NSA in the 21st Century (NSA21) is the agency’s first major reorganization in 15 years. The two-year reorganization will establish six new directorates under a centralized NSA operating framework. Those directorates include: Business Management and Acquisition; Engagement and Policy; Operations; Capabilities; Workforce and Support Activities; and Research.

The goal of the reorganization is better integration. The roughly 3,000 people who perform information assurance will be moved into the new Directorate of Operations alongside foreign signals intelligence and cyber defense forces. And Dukes has been given a new role as well: deputy national manager for national security systems.

NSA21 is not the first major reorganization for the once super-secret NSA. In 1999, a group of midlevel managers at NSA produced the New Enterprise Team report, which was highly critical of the agency’s leadership and intelligence failures. Michael Hayden, the NSA director at the time, described the group of 19 managers as “responsible anarchists,” and immediately set out on his “100 Days of Change” initiative. It was the NETeam assessment that led to the creation of the many post-9/11 global surveillance programs, which remain highly controversial.

But it has been the revelations of NSA’s global surveillance activities that has some privacy and civil liberties groups unhappy with the current reorganization plan. They argue that keeping information assurance closely allied with NSA’s foreign intelligence mission leaves open the possibility that the agency can insert vulnerabilities and back doors into systems and commercial products whenever it suits its needs.

Those concerns are not lost on NSA officials, but they insist that the intelligence mission is central to making information assurance more successful in a highly complex, global network environment where attributing attacks is extremely difficult. Dukes and other officials point to NSA’s continuing collaboration with industry giants, like Microsoft and the Linux community, to help improve operating system security, and their routine issuance of unclassified operational risk notifications to private owners of critical infrastructure as areas where the agency’s intelligence insight has been helpful.

This integration will become even more critical as the Internet of Things powers new attacks in an era when, as one official put it, “no network seems to be off limits.”

The Weekend Reader-Aug. 12

Interactive Map Uses GIS Tech to Combat Zika

meritalk.comThe U.S. Department of Health & Human Services Office of the Assistant Secretary for Preparedness and Response created a publicly available interactive map showing the number of Zika virus cases in each state. Zika virus is spread to people primarily through bites from infected Aedes aegypti mosquitoes or through sexual contact.  The health impact is greatest on growing fetuses, which can develop a serious birth defect called microcephaly. “Prevention is the first course of action in protecting public health, but people need information to make decisions about what preventive actions to take,” said Este Geraghty, chief medical officer and health solutions director, Esri. 

 

Feds Newly Welcome at Hacking Conventions

meritalk.comGovernment employees who attended the hacking conventions of the past had a pretty hard time remaining unnoticed, as many hosted “Spot the Fed” games that rewarded attendees for outing Federal employees. Today’s hacking conventions, like Black Hat and Defcon that took place earlier this month, are creating a much more collaborative environment. “We wanted to do outreach to the hacker community,” Federal Trade Commission chief technologist Lorie Faith Cranor said, adding that her agency wanted to encourage communication and collaboration with cyber experts.

 

USDS Celebrates Accomplishments on 2nd Birthday

meritalk.com“We’re trying to make government work better by bringing in top talent and best practices from the technology industry,” said Matt Cutts, USDS software engineer. USDS digitized an external application and internal review process for immigration applications and requests, including the green card renewal application; and launched a digital stamp approval process for agencies processing refugees who have been interviewed and have cleared security and background checks. The digital service team also assists in the day-to-day maintenance of HealthCare.gov, which helps Americans sign up for access to health care provided by the Affordable Care Act.

 

DeSalvo Steps Down as ONC Coordinator; Deputy to Take Over

meritalk.com

The Department of Health and Human Services  announced that Vindell Washington will take over as head of the Office of the National Coordinator for Health IT, according to an internal memo issued by HHS Secretary Sylvia Burwell. Washington has been serving as principal deputy national coordinator under Karen DeSalvo since January. DeSalvo, who began in 2014 as national coordinator for Health IT, for the past two years has simultaneously filled both the national coordinator role and acting assistant secretary for health.

 

 

Purdue Uses Big Data to Benefit Students

meritalk.comEight years ago, Purdue University students could scroll through their BlackBerrys using the institution’s Signals application to learn about their risk of failing a particular class. Now, they can use the school’s new app, Forecast, to learn not only how difficult a class is, but also which courses may be enjoyable for them. Forecast, which was released in March, uses data analysis to help students do well in school and maintain healthy habits.

 

Four Key Elements for Encrypted Traffic Management

Use of Secure Sockets Layer (SSL)/Transport Layer Security (TLS) encryption is estimated at 15-25 percent of all network traffic, and growing at 20 percent annually. Some industries, such as Federal, finance, and healthcare, have 70-80 percent of their traffic encrypted. But by 2017, Gartner predicts “more than 50 percent of network attacks will use SSL/TLS.”

Agencies need to inspect encrypted traffic to ensure hackers are not hiding in SSL traffic.

The Situation Report: 3-D Guns, Teleworking, and EHRs–What Could Go Wrong?

3-D Printing Future Threats

The Transportation Security Administration last week discovered 68 firearms in carry-on bags around the nation. Of those, 59 were loaded and 21 had a round chambered.

Gun made with 3-D printed components. (Photo: TSA)

But one of those loaded guns was different. One of the loaded weapons discovered by TSA screeners at Reno-Tahoe International Airport was constructed of parts made with a 3-D printer.

“While it was a realistic replica, it was loaded with live ammunition,” the TSA said in a blog post this week. “This was a good catch from the TSA team at Reno (RNO)! While firearms are permitted in checked baggage, we strongly suggest making yourself familiar with local laws prior to flying with a printed firearm.”

It’s not illegal to make your own firearm using a 3-D printer–a process that takes less than 24 hours using today’s high-end printers. But my West Coast listening post has learned that California Gov. Jerry Brown signed a law last month that requires makers of 3-D printed guns and other homemade firearms to apply for an official serial number from the Department of Justice, a process that requires a background check.

Teleworking @USPTO

The U.S. Patent and Trademark Office has fully embraced the concept of telework. My USPTO surveillance station reports that as of the fourth quarter of 2015, up to 93 percent of USPTO’s workforce was eligible for teleworking one or more days per week–that’s more than 10,000 employees.

USPTO takes pride in the fact that the agency provides all of the equipment and systems necessary for their employees to do everything at home that they normally would in the office. But an intercepted intelligence report from USPTO’s inspector general shows that the agency has some challenges when it comes to keeping tabs on that equipment and the employees that have too much.

All hoteling equipment is tracked in the agency’s Enterprise Asset Management System (EAMS). But according to the IG, USPTO hasn’t been conducting physical inventories of the equipment. Instead, the agency was relying on employees to self-certify the existence of the equipment. And that has led to a few problems.

lost laptopThe average teleworker is issued several standard pieces of equipment: a Universal Laptop, Virtual Private Network (VPN) connection, Cisco Voice over Internet Protocol (VoIP), Microsoft Lync, webcam, Cisco WebEx, and a small office/home office (SOHO) router. But the IG discovered that some employees had been issued multiple laptops, routers, and monitors. Investigators also discovered that when some of those teleworkers separated from the USPTO, they did not certify that the equipment they had been issued had been returned to the agency.

And remember that EAMS database I mentioned? USPTO also unwittingly gave at least one employee read and write privileges, allowing that person to make changes to the inventory system without independent review or approval. USPTO officials also gave this employee additional responsibilities, putting him in charge of PCs and simultaneously making him a member of the review board responsible for investigating incidents of lost or stolen equipment.

“As a result, this particular staff member was directly responsible for property control and served on the board that decides financial responsibility for lost or damaged property.”

VA Moving Closer to Commercial EHR?

My Vermont Avenue listening post has picked up strong signals that the Veterans Administration is actively pondering what it will require to manage transitioning from its legacy electronic health record, known as the Veterans Information Systems and Technology Architecture (VistA), to a commercial EHR.

You’ll recall in April that Congress was not happy when it learned that the Veterans Health Administration had not yet made a decision on whether to move forward with a commercial scheduling system or to continue putting money into its own VistA enhancements. The Situation Report, however, has intercepted a VHA request for information that is seeking “guidance and recommendations on all aspects of the change management associated with this VHA COTS EHR acquisition and transition.”

ehr2According to the RFI,  the new commercial EHR “would support clinical workflow, evidence-based practice, and patient safety.  It would provide clinicians, patients, and administrators the data, analytic power, and user interfaces required to monitor the effectiveness of care and improve veteran care over time.  The modernized VHA system of systems of the future will include more than just a COTS EHR in order to facilitate and automate business processes that support access and veterans care.”

The RFI is good news, but it doesn’t mean VHA is going to pull the plug on VistA anytime soon. According to a senior VA official, who spoke to MeriTalk on background, VHA has endorsed the Digital Health Platform strategy developed by VA’s chief information officer, but it has not yet made a decision on the future of VistA. That strategy provided VHA options to continue using VistA or to move to a commercial EHR.

“VHA endorsed the strategy including the option to move to COTS, but the fact that it’s an endorsement of a strategy is important context,” the official said. “A decision to move forward and procure a COTS EHR is still a pending decision–one which will be informed by findings from RFI(s), cost estimating, and other planning efforts,” the official said. “Finally, I’d highlight that we are continuing our current VistA 4 (i.e. VistA Modernization) plans through FY18.”

FedRAMP Discussion Page

MeriTalk and GSA are working together to connect the new Technology Transformation (TTS) leadership with industry and government to enhance collaboration on key issues – FedRAMP and 18F.  We want your feedback.

We will hold an interactive session September 13th at the Newseum in Washington D.C. where David Shive, the new Commissioner for GSA’s TTS, and his GSA colleagues will talk about the future for FedRAMP and TTS.  Get the discussion started now by joining in on the online conversation — we’ll consider your input to help shape the agenda for September 13th.  We’re all ears.

Let us know what you think of the below:

  • What are the biggest challenges and opportunities facing FedRAMP?
  • How can GSA improve FedRAMP?
  • How can GSA pivot the program to increase value and reduce cost in reaction to government and industry feedback?
  • How should we measure success?

MeriTalk and GSA are working together to connect the new Technology Transformation (TTS) leadership

MeriTalk and GSA are working together to connect the new Technology Transformation (TTS) leadership with industry and government to enhance collaboration on key issues – FedRAMP and 18F.  We want your feedback.

We will hold an interactive breakfast session September 13th at the Newseum in Washington D.C. where David Shive, the new Commissioner for GSA’s TTS, and his GSA colleagues will talk about the future for FedRAMP and TTS.  Get the discussion started now by joining in on the online conversation – we’ll consider your input to help shape the agenda for September 13th.  We’re all ears.

Let us know what you think of the below:

  • How should TTS work moving forward?
  • How should stakeholders provide ongoing input to GSA?
  • How should GSA measure success?

The Weekend Reader-Aug. 5

Olympics Cybersecurity is Like Protecting a Major Company, Symantec Says

meritalk.comHow do you approach managing the cybersecurity of an event as massive and popular as the Olympics? According to Symantec’s vice president for the Americas, Rob Potter, treat the event like a Fortune 100 company. “I think it’s very, very similar, both in dollar amounts and in terms of interaction and people, as a Fortune 100 company for the period of time that the Olympics are,” Potter said.

 

Uber Security Specialist Offers Cyber Advice to Feds

meritalk.comThe Federal government should focus more on defensive cybersecurity measures, work around the regulatory culture of government, and hire more in-house cybersecurity professionals, according to Alex Levinson, information security specialist at Uber. “The government puts a lot of eggs in the offensive basket,” Levinson said. The private sector, which is motivated by profits, differs from the government in that agencies can spend money on developing the latest offensive cyber technologies, because they don’t have to worry as much about money loss, according to Levinson.

New Federal Data Center Initiative Takes Over

meritalk.comAgencies must install energy measuring systems to track power usage, complete virtualization and server utilization metrics to ensure that equipment is being used efficiently, and track the use of space in Federal data centers. The new Data Center Optimization Initiative also includes a power usage effectiveness target to increase energy efficiency. Over three years, agencies must close 25 percent of their tiered data centers and 60 percent of their non-tiered data centers.

 

IBM Forms X-Force Red Security Testing Group

meritalk.comThe company announced Aug. 2 that X-Force Red will consist of hundreds of security experts based in dozens of locations around the world. The team, part of IBM Security Services, will also examine human security vulnerabilities in daily processes and procedures that attackers often use to circumvent security controls. X-Force Red is the latest addition to IBM’s other X-Force divisions and will actively share threat intelligence with IBM X-Force Research, IBM X-Force Exchange threat sharing platform, and IBM Security AppScan.

 

FAA Announces Drone Advisory Committee

meritalk.comOver U.S. aviation’s 100-year history, 320,000 people have registered to operate manned aircraft. Over the past eight months, 520,000 people have registered to use Unmanned Aerial Vehicles (UAVs). The Unmanned Aircraft Safety Team will include representatives from the drone and aviation industry; this team will analyze safety data from drones and attempt to mitigate safety concerns.

 

The Situation Report: Your Bank’s Security Probably Stinks

Legacy Threats–They’re Not Just For Government Anymore

My Wall Street outpost reports a new concern among financial institutions–legacy systems. That’s right. Regulations focusing on “too big to fail” have ignited a flurry of mergers and acquisitions in the financial industry, which in turn has created a legacy system vulnerability problem that may be responsible for the majority of data breaches reported to date.

“As banks continue to grow through acquisition, legacy IT systems and their vulnerabilities are also acquired. In many cases, they remain in place for years,” said Sam Kassoumeh, co­-founder of SecurityScorecard. The company this week released its 2016 Financial Cybersecurity Report, which studied 7,111 financial institutions including investment banks, asset management firms, and major commercial banks around the world.

The Situation Report received the following FLASH message from SecurityScorecard:

  • The U.S. commercial bank with the weakest security posture is one of the top 10 largest financial service organizations in the U.S (by revenue).
  • Only one of the top 10 largest banks, Bank of America, received an overall A grade.
  • 95 percent of the top 20 U.S. commercial banks (by revenue) have a Network Security grade of C or below.
  • 75 percent of the top 20 U.S. commercial banks (by revenue) are infected with malware and a number of malware families were discovered within these banks, including Ponyloader, and Vertexnet.
  • Nearly 1 out of 5 financial institutions use an email service provider with severe security vulnerabilities.
  • 16 percent use an enterprise cloud storage provider that has received a grade of F in Patching Cadence and a grade of D in Network Security and IP Reputation.

bank security grades

So, you might be wondering what specific vulnerabilities have been discovered at the nation’s biggest banks and financial institutions. Here’s a look.

  • 18 out of 20 commercial banks support one or more weak or insecure Transport Layer Security (TLS) cipher suites.
  • 15 out of 20 commercial banks have a Secure Sockets Layer (SSL) certificate that is expired.
  • 9 out of 20 commercial banks have open File Transport Protocol (FTP) ports found.
  • Generic malware was found in 15 out of 20 commercial banks.
  • Ponyloader (steals credentials and bitcoin wallets) was found in 14 out of 20 commercial banks.
  • Vertexnet (botnet) was found in 9 out of 20 commercial banks.
  • Keybase (keylogger) was found in 8 out of 20 commercial banks.
  • Malware events were detected in all 20 commercial banks over the past 365 days.
  • More than 422 malware events during the past year were detected in just one of the commercial banks.
  • A total of 788 malware events were detected in all 20 commercial banks over the past 365 days.

Defense Acquisition Workers

How many Defense Department civilian and military employees does it take to manage the Pentagon’s contract obligations? Well, it appears that nobody inside the five-sided puzzle palace or in Congress really knows the answer to that question.

My E-Ring listening post has intercepted some startling historical data that shows as defense contract obligations reached record highs in 2008, the size of the acquisition workforce in the Defense Department actually shrank to levels not seen since the mid-1990s. And since 2008, as contract obligations have dropped by hundreds of billions of dollars, the Pentagon increased its acquisition workforce by more than 30,000.

dod acq workforce

While the number of acquisition workers may not be keeping pace with the long-term increase in contract obligations and the massive complexities of the modern acquisition environment, the good news is that the workforce appears better prepared to handle it than ever before.

According to DOD officials, certification and education levels have improved significantly: Currently, more than 96 percent of the workforce meet position certification requirements and 83 percent of the workforce have a bachelor’s degree or higher.

Blurred Lines: How Cloud is Re-Defining Public/Private Partnership

Federal IT executives are focused on the future.  And, as agencies consider modernization strategies and options, most agree that cloud will be a foundational component.

While cloud conversations have been ongoing for many years, widespread use of cloud models remains a challenge.  There is still confusion about choices, migration paths, and which cloud offerings are available for different types of workload.  Fortunately, the burgeoning relationship between government and industry partners helps agencies cut through this cloud confusion.

An agency’s first step in pursuit of cloud is the establishment of a cloud strategy. Once a strategy is finalized and your agency begins implementation, the reality of choosing a cloud option sets in. Selecting the right type of cloud for your agency requires the consideration of a multitude of factors, including:

  • Personnel and organizational items
  • Application environments
  • Migration process
  • CapEx vs. OpEx
  • SLAs
  • Private or public
  • On or off-premises

Another key to agency success is working collaboratively with cloud vendors, agency acquisition personnel, and technical teams to create cloud procurement best practices.

The Cloud Starting Line: Funding Model, SLAs, Metrics, and a Checklist

  • Ask the right questions about service levels, standards, and metrics – specifically, modifying SLAs to address cloud models – when building your cloud foundation
  • Determine which funding model best fits your budget – taking CapEx vs. OpEx into consideration
  • Identify the core elements for which cloud stakeholders will be responsible
  • Create a checklist of necessary milestones with all critical parties to ensure migration success

Cloud Education – Bring Cloud Into Focus

Leverage your public/private sector partners to walk your agency through the procurement and migration process step-by-step.  Education leads to better decisions for cloud success.

  • Be proactive externally: Host procurement and operational events to further the public/private discussion on cloud – like some agencies, such as DHS, are currently doing
  • Be proactive internally: Bring in multiple departments for panel discussions to foster active learning across your agency

And, spark discussion on topics ranging from managing cloud operations, to developing pricing strategies, to determining which apps are cloud-ready, to discussing the different purchasing approaches in public and private cloud.

Cloud requires a greater communication through the procurement process.  As Fed IT leaders develop their migration strategy and implementation plans, education serves as the key to ensure their teams understand how to buy, run, and resource future technology – and understand how to implement the procurement and pricing aspects of their cloud environment.

 Better Together Cloud Conversations

Cloud Service Providers (CSPs), customers, and end-users should all provide input during the cloud contract negotiation process – capturing expectations and requirements of the customer and end-user.

As all cloud contracts and SLAs are unique, and entail a huge range of possibilities, agencies (especially those procuring cloud for the first time) will benefit from outside help to ensure they are not overlooking mission-critical details.  For example, a procurement professional experienced in structuring cloud computing contracts can help define the cloud terminology found in the contract – setting clear expectations for roles, responsibilities, and metrics.

Particularly around cloud, increased communication and collaboration between agencies and industry partners is critical for success – as clarified and even encouraged in OMB’s Myth Busting Memo.  Fostering the public/private conversation will enable agencies to develop a business case that includes rigorous, systematic analysis of the return on investment (ROI) of various cloud solutions – before signing on to a preferred system.

At ViON, we foster public/private engagement by supporting your agency during migration.  From identifying agency goals to setting up the right funding model and SLAs to assuming the risk of actual migration, we make sure you don’t miss mission-critical details so you can focus on building your perfect cloud.  And that’s the real silver lining.

Learn more about how approaching cloud as an investment strategy can help your agency’s public/private partnerships.

This blog post was originally published here.

The Weekend Reader-July 29

Policy Should Prep Workforce for Tech Future, Experts Say

meritalk.com“[Politicians] are going to have to be developing policies in their local areas to permit a lot of the fruits of new technology,” said Rosabeth Moss Kanter, Ernest L. Many of those policies have to do with preparing for jobs that increasingly require technological experience, such as building infrastructure. “Those jobs don’t necessarily require STEM skills, but they should and they will as technology is increasingly embedded in our infrastructure,” Kanter said.

N.Y. High School Offers Wi-Fi on School Buses

meritalk.comA sophomore at Watkins Glen High School can use the 45-minute bus ride to her rural home to do her schoolwork with her own personal device. The quarterback of the high school’s football team can complete his assignments on his hour and a half journey to a game at a neighboring school. According to school district Superintendent Tom Phillips, about 20 percent of students in the area come from rural homes that have little or no Internet connection.

Special Report: The Future of Telehealth

meritalk.comTelehealth, the delivery of health care services while the patient is at one site, and the licensed health provider is at another site, is here. But what does  the future hold in terms of cost, coverage, consumer demands, and legislation? MeriTalk takes an in-depth look at those challenges, and talks with industry leaders about what is not just a novel idea or futuristic concept.

 

 

 

Industry Supports White House Cyber Directive

meritalk.comThe Presidential Directive that defined roles and responsibilities of Federal agencies in the event of a cyber incident is being applauded as a step in the right direction by private sector cybersecurity companies. “Clarification on who to contact is important, but the larger challenge is identification and classification of the threat level defined in the schema, and how quickly that determination can be made.  It’s a step in the right direction and heightens the need for improved incident preparedness and coordination. We’re getting a step closer to a national cybersecurity weather map.” Much like a weather map, a schema released in conjunction with the directive provides a color-coded graph to measure incident severity and ensure that all parties involved measure their cyber incidents on the same scale.

IT COST Commission Offers Tips for FITARA Compliance

meritalk.comChief among these recommendations, which include tips on optimizing IT spending and consolidating data centers, is the need for CIOs to demonstrate transparency. The commission said that improved transparency can also optimize business demand and customer satisfaction. “While not without shortcomings, transparency is a powerful tool for applying the economic forces of supply and demand to IT,” the report says.

 

The Situation Report: DHS Cyber Reorganization Gains Support

The Department of Homeland Security’s long-standing plans to reorganize the National Protection Programs Directorate (NPPD) to better deal with the growing threat of cyberattacks on national critical infrastructure may have received the boost it needed this week to obtain congressional approval.

In addition to establishing a coordination structure for responding to cyber attacks against the country, the new Presidential Policy Directive on United States Cyber Incident Coordination (PPD-41) has tasked DHS to write a national cyber incident response plan for critical infrastructure within the next 180 days. And that may be the key to getting Congress to approve the reorganization plan, according to Secretary of Homeland Security Jeh Johnson.

situation report logo“We’re much more focused on cyberattacks on critical infrastructure, which is why I want to reorganize our National Protection Programs Directorate (NPPD), which is run by Suzanne Spaulding, into a cyber and infrastructure protection agency so that we, in a lean and mean way, marry up our cyber experts with our critical infrastructure protection experts into one agency working side-by-side,” Johnson said, speaking Wednesday at the annual Aspen Security Forum.

“That requires congressional approval. The House Homeland Security Committee is interested in this. I’m hoping that they will push it through the entire House and get it through the entire Senate,” Johnson said. “Addressing cyber events focused on critical infrastructure is and has to be a national priority.”

Development of a national cyber incident response plan is long overdue. It was first called for in the National Cybersecurity Protection Act of 2014, sponsored by House Homeland Security Committee Chairman Rep. Michael McCaul, R-Texas. The new incident response structure created as part of PPD-41 is a step in the right direction, McCaul said.

“This vital plan will help ensure these recently passed cybersecurity laws we have been fighting for will be fully implemented and effectively carried out to strengthen our nation’s cybersecurity,” McCaul said in a statement issued in response to the release of PDD-41. “Finally, I hope the administration will take quick action to further clarify the parameters and the rules of engagement for cyber warfare.”

Refocusing DHS on cyber defense, response, and mitigation for critical infrastructure, such as the electric power grid or the financial services sector, comes at a logical time for the agency—which remains a work in progress in terms of integrating the 22 formerly independent departments and agencies that became DHS. The agency, and the nation as a whole, is facing a world in which nation-states have shifted from relying on cyber for purely intelligence collection operations to conducting more offensive attacks designed to manipulate political and economic outcomes in the real world.

Still, there remain differences of opinion on exactly what the restructuring of the NPPD should look like. The House Homeland Security Committee in June advanced a bill—the Cybersecurity and Infrastructure Protection Agency Act of 2016—that would keep the National Cybersecurity Division and the Infrastructure Protection Division separate entities.

The White House attracted the ire of some lawmakers earlier this summer when a draft DHS reorganization plan was leaked to the media and hadn’t been briefed to Congress, which has the authority to approve or disapprove any such reorganization. The perception that the Obama administration was planning to move forward unilaterally with a DHS reorganization did not help Johnson’s chances of getting support for his plan. Now, with PPD-41 in place and a nascent governmentwide cyber incident response structure taking shape, the DHS reorganization plan makes more sense than ever before.

“There’s the cop and there’s the fireman,” Johsnon said, describing the intent of PPD-41. “Jim Comey is the cop and I’m the fireman,” he said, referring to FBI Director James Comey. “So, when you want to report the crime, the hack, the threat, you go to law enforcement. If you need somebody to help you put out the fire—plug the vulnerability, prevent it from spreading, and root out the bad actor from your systems—the Department of Homeland Security is in the lead.”

Address the Unknown with Threat Intelligence

Initially, threat classification focused only on malware or botnets – leaving the majority of web traffic unrated, and agencies exposed to vulnerabilities. The unrated information quickly became a problem as the threat landscape continued to change – new threats emerged, more data collected, complex technologies introduced. “The damage factor can be much higher than before,” warned Chris Larsen, architect on the WebPulse Threat Research Team, Blue Coat.

The Perils of Mobile and Cloud Security: An Argument for Centralized Smartcards

Government agencies have moved more into the app- and cloud-centric culture that is increasingly common in most enterprises. Now, privileged rights previously reserved for an administrative user are undergoing a transition where those rights are being segregated among a number of administrators for role separation requirements. That makes user authentication more important than ever when accessing mission-critical information.

Federal mandates such as OMB’s 30-day Cybersecurity Sprint and the Cybersecurity Strategy and Implementation Plan (CISP), along with technology trends like the Internet of Things and Bring Your Own Device, put greater emphasis on identity and authentication technologies. The CSIP in particular requires derived credentials solutions and other strong authentication solutions for mobile devices, to improve mobile device management on a broader scale.

Of course, mature applications and workflows still require public key infrastructure (PKI) credentials. Smartcards work well for authentication at traditional endpoints. Smartcard-based encryption and authentication is also effective for end users’ laptop and desktop computers, and for applications such as secure email, virtual private network access, PKI-enabled Web servers, and network smartcard logon.

For mobile devices, however, smartcard-based authentication is more complicated. PKI credentials on smartcards do not translate efficiently to the mobile environment.

As endpoints increasingly address multiple mobile devices–laptops, desktops, thin clients, smartphones, tablets, and more–smartcards with PKI credentials are no longer the best solution. Smartcard readers can be cumbersome, microSD cards can be easily lost, and embedded PKI only works on specific smartphones. Software-based credentials must be replicated onto each one of a user’s devices.

What’s more, these approaches typically require their own management solution, which can be an administrative and security nightmare.

Securing PKI Credentials in Mobile and Virtual Environments
Because smartcards such as the Common Access Cards (CAC) and Personal Identity Verification (PIV) cards are not easily used with a mobile device, many agencies are looking to move to a “derived credential” model. In derived credentials, user identity credentials are presented in alternate form factors that are more mobile device friendly. The typical form factors proposed as solutions are external hardware and embedded hardware or software security modules.

Unfortunately, external hardware such as microSD cards and USB tokens often have inconsistent mobile device support, and are susceptible to being lost or stolen. Embedded security modules can be simpler to use, but they present credential management issues–every end user devices requires a separate credential to be provisioned, audited, and maintained.

Virtual desktop environments improve security for many agencies, but they also make smartcard-based PKI operations complicated. Each thin-client endpoint (including mobile devices) may need custom driver software to connect between the attached smartcard and the applications running within the virtualized environment.

This is all made more complex still when a single endpoint is used to simultaneously access multiple virtual environments by having to share a single physical smartcard. If each virtual environment issues its own identity credentials, users may have to swap smartcards in and out of their local smartcard reader, accessing only one virtual environment at a time.

Some enterprises try to avoid smartcard usage simply by deploying software-based PKI credentials. This can solve some problems, but they still face the security risks of software-based keys, with multiple user credentials sent to each user’s various endpoints.

The case for “centralized smartcards”
A more appropriate and more easily managed approach to security would be what might be called “centralized smartcards.” This type of security management allows administrators to issue users a single identity, accessible from a range of devices. Users’ PKI credentials are maintained in a secure, centralized server, with crypto operations handled from that hardware.
When an end user needs to perform a smartcard operation, the application on the endpoint would connect to a virtual smartcard reader. This would redirect crypto operations to the appropriate virtual smartcard in the centralized smartcard server. An additional security layer between the endpoint and the smartcard server provides secure transport and permits use of a variety of authentication methods for selection of an end user’s virtual smartcard.

A centralized smartcard approach would need no changes made to endpoint virtual smartcard or the PKI-enabled applications that require smartcard authentication or digital signatures. By centrally maintaining each user’s PKI credentials, users can use their same PKI keys and certificates from any endpoint.

With this approach, all PKI credentials are housed in a central location, greatly simplifying security infrastructure audit and reporting needs. User credentials (including derived credentials called for in the CISP) are never at risk of theft or loss of a separate hardware credential or the mobile device itself. A single user credential can be accessed from any and all end user devices.

In virtual environments, a centralized smartcard would considerably improve smartcard management realm. End user PKI credentials would be centrally located in a secure environment, just like the virtual desktop infrastructure model. And without the requirement to use a physical smartcard reader, the end user is free to access multiple virtual environments using a different credential, or derived credential, for each environment.

As the endpoint continues to evolve, agencies must provide a simple way for users to access everything from external cloud applications to internal secure networks from a wide variety of devices while meeting security requirements and compliance mandates. A centralized smartcard approach could greatly simplify authentication, providing users with secure access to the many networks and applications being used in our increasingly mobile and cloud-centric world.

Bill Becker is the technical director for SafeNet Assured Technologies. He can be reached at Bill.becker@safenetat.com

The Weekend Reader-July 22

2 House Bills Contend for IT Modernization

meritalk.comMany members of Congress can agree that IT modernization is an important problem in need of a solution, but there is less agreement on how exactly to go about it.   Two bills focus on the same area of Federal IT needs, but their differences do not necessarily mean that they are contradictory. The symbiotic nature of the bills is evidenced by the fact that some congressmen have cosponsored both bills, such as Rep. Gerry Connolly, D-Va.

 

Student Financial Aid Tied to Cybersecurity Compliance

meritalk.com“Postsecondary educational institutions entrusted with student financial aid information are continuing to develop ways to address cybersecurity threats and to strengthen their cybersecurity infrastructure,” wrote Ted Mitchell, the under secretary of the Department of Education. The Gramm-Leach-Bliley Act Safeguards Rule requires universities to: Develop, use, and maintain a written information security program as well as determine employees responsible for coordinating the information security program.

Republican Party Platform Addresses Tech

meritalk.comThe Republican Party platform, released during the convention in Cleveland that chose Donald Trump as the nominee, explains the party’s views on technology including broadband expansion, net neutrality, cybersecurity, education, and health care. The platform emphasizes the party’s views that the government should invest in more broadband development.  “At the cost of billions, the current administration has done little to advance our goal of universal broadband coverage,” stated the Republican Platform.

Intelligence Committees Restrict Privacy Board

meritalk.comThe House and Senate Intelligence Committees each passed restrictions on the Privacy and Civil Liberties Oversight Board that would restrict its funding, give it jurisdiction only over the privacy of people in the United States, and force it to report to the agencies that it’s overseeing. HR 5077 has passed the House and was referred to the Senate Select Committee on Intelligence. S 3017 was introduced in the Senate last month. “Intelligence authorization bills are neither the appropriate vehicle for authorizing spending for the PCLOB, nor do they pass every year,” Sen. Patrick Leahy wrote.

 

 

The Situation Report: Precision Dental & CIA Modernization

meritalk.comThe Situation Report would like to know why the technology revolution has completely bypassed the world of dentistry? Your humble correspondent had a close encounter with a dentist this week and found the entire experience like living through a battle scene in Conan the Barbarian. Now, anybody who sits within 6 feet of me at the MeriTalk office can tell you that this former Marine is one big baby when it comes to going to the dentist.

 

The Situation Report: Precision Dental & CIA Modernization

White House Needs to Get Behind Precision Dental

As we reported this week, the Obama administration recently announced a series of new investments, partnerships, and policies to further the Precision Medicine Initiative (PMI), including $55 million in awards from the National Institutes of Health (NIH).

The Situation Report, however, would like to know why the technology revolution has completely bypassed the world of dentistry? Your humble correspondent had a close encounter with a dentist this week and found the entire experience like living through a battle scene in Conan the Barbarian.

Now, anybody who sits within 6 feet of me at the MeriTalk office can tell you that this former Marine is one big baby when it comes to going to the dentist. But there is something to be said for the utter lack of innovation that currently plagues what I’ll call the last meter in dentistry—that is the last three feet between the ax-wielding maniac in the white jacket and the delicate layer of skin that separates the roof of your mouth from your brain housing group.

Don’t get me wrong—the process of taking X-rays and using high-definition monitors to instantly view the intricate details of your soon-to-be former molar has certainly come a long way from the days when you had to go back to the waiting room and wait for your pictures to develop. Likewise, the ability of dentists to instantly call up your records while you’re sitting in the chair and know exactly what they did to you during the last visit is a nice improvement.

situation report logoBut the bone-crushing procedure that is a tooth extraction, coupled with that amazing gagging sensation that immediately draws the attention of the crazy lady holding the giant turkey baster that almost sucks your lungs out of your chest, is something right out of the Dark Ages.

Please, if somebody at NIH is reading this, put some of that $55 million toward a Precision Dental Initiative.

FedRAMP

My listening post outside the FedRAMP Program Office has picked up some new data. Ashley Mahan, the FedRAMP evangelist, reports there are currently 24 agencies, 83 authorized cloud service providers, and 41 third-party assessment organizations taking part in the FedRAMP program.

In addition, FedRAMP is hard at work developing its own dashboard application that will be hosted on the FedRAMP website and will provide what Mahan called “near real-time authorization status” for all CSPs. That capability is slated to go operational in August, according to signals intercepted from Mahan.

Cloud Acquisitions

My remote sensor network has also intercepted reliable reports that the General Services Administration is developing a new Cloud IDIQ contract for fiscal year 2018. The indefinite delivery/indefinite quantity contract will provide pre-negotiated ceiling prices for cloud services with standard baseline agency requirements, similar to the IT Schedule 70 and the Email-as-a-service (EaaS) blanket purchase agreement.

If any agency chief information officer is unsure about how to “get to the cloud,” we’ve intercepted reliable information that GSA’s Cloud Computing Program Office will provide free guidance on market research, and full scope reviews for cloud statements of work, performance work statements, statements of objectives, and other acquisition documents.

CIA Modernization & Encryption

CIA Director John Brennan told a few hundred guests of the Intelligence and National Security Alliance this week that the agency’s restructuring—which features the creation of a fifth directorate focused on digital innovation—has finally overcome whatever minor opposition was first encountered.

CIA Director John O. Brennan speaks to INSA members July 19, 2016.
CIA Director John Brennan speaks to INSA members on July 19. (Photo: INSA)

“What I’ve said to our people is, we’re not trying to homogenize everybody to create a single intelligence officer,” Brennan said, according to intercepted signals from this week’s INSA Leadership Dinner in Tysons Corner, Va. “There is great pride in being a case officer, an operations officer, great pride in being what I think is the gold standard of analysis in being an analyst in the CIA.  So we want to try to leverage that pride, but bring it together so that they are able to interact with one another in a manner that empowers both their capabilities and mission.”

Brennan also reiterated his earlier calls for a congressional commission to foster dialogue with government and industry about the use of encryption and government’s role in the digital world.

“The government wants encryption; the government wants strong encryption,” Brennan said. “I do think there needs to be a much more candid discussion and honest discussion publicly about the role of government in the digital domain.  This is what is really, I think, going to affect our ability as a government, as an intelligence community, to keep this country safe.”

1 8 9 10 11 12 19