Smarter Gov Tech, Stronger MerITocracy
Menu
This page is not built out yet. If you are seeing this page, please contact an administrator.

EA MIA?

Asked about the best way to deal with the Y2K problem, an IT consultant quipped, let’s find the fella that fixed Y1K – and get him back on the job. It wasn’t Methuselah magic that mended the millennium madness, it was good old fashioned auditing and a commitment to Enterprise Architecture. After Y2K, IT, like a reformed drinker, took the pledge to skip the bottle and hit the EA gym. 15 years later, seems our heroes back on a high stool.

EA OBE?

As 1999 became so last millennium, EA fell from grace. It became a confusing resource draw – and failed to clearly communicate its value to the business side. OMB and GAO provided plenty of guidance, methods, and surveys – but folks stopped paying attention. When was the last time you saw EA on a conference agenda? So, is EA dead – and if so, should anybody mourn his passing?

EA, CDO, FDCCI, and More…?

Yes, the taxpayer will cry. We certainly can’t afford to have EA slop off into oblivion. Consider Uncle Sam’s ballooning data center volumes – from 732 in 2010 to more than 10,000 in 2015. Consider the open data opportunity – and the emerging role of the CDO. Consider shared services in the cloud. You quickly come face to face with the IT sphinx. You can’t manage what you can’t see – and it’s impossible to count if definitions change. What is shared services if not a map back to Mark Forman’s FEA?

EA APB?

So, if EA makes so much sense, why isn’t it happening? Two primary challenges. By definition, EA is holistic – it cuts across agency boundaries, that means breaking budgetary rice bowls. Agencies, politicians, and contractors don’t want to surrender control. Second, everybody wants results now – appointees typically serve two years. Few are interested in taking the long, strategic view – that may put feathers in somebody else’s cap.

EA FITARA?

How do we breathe new life into the dark science? FITARA presents just the tonic. Join us on August 11th at the Newseum in D.C. for the FITARA Forum. Tony Scott, OMB’s FITARA leads, CIOs, and GAO. Register today here. We can’t afford to wait another 1,000 years to get agencies current on EA.

Moving Day

July is the most popular month to move, according to the American Moving and Storage Association.

Homeowners and renters aren’t the only ones boxing up their paperbacks and photo albums. Federal agencies are doing the same thing. But they’re moving to the cloud.

Packing Up
The Department of Defense (DoD) may have the most boxes to pack, so MeriTalk produced a new report that focuses on the agency’s efforts to migrate apps to the cloud.

Turns out they’ve done some heavy lifting already – 57 percent of DoD apps in the cloud today were migrated from legacy systems, according to “DoD’s Move to the Cloud: Box it Up or Build New?”

Liking the New Neighborhood
Moving is hard on everyone, not just the people lifting those heavy boxes, but DoD sees a lot of advantages from moving apps to the cloud:

  • 87 percent say cloud provides greater agility
  • 87 percent say it saves money
  • 87 percent say it saves time
  • 86 percent say it provides better security

Build New
Sometimes DoD doesn’t have to pack up and move anything – that’s because 43 percent of the apps in the cloud today were built there. That’s a good way to avoid hurting your back.

Rather than move apps from legacy systems, 52 percent of IT professionals said the smarter move is building apps in the cloud. Why?

  • 56 percent cite better security
  • 51 percent cite the speed of deployment
  • And 48 percent cite the opportunity to reduce redundancies

But 43 percent also cite lack of funding as their biggest hurdle preventing them from building new apps in the cloud.

Settling In
DoD is nesting, and they can’t wait to do more to make cloud feel like home. The agency hopes to have 57 percent of all applications in the cloud by 2020, MeriTalk says in the report, “DoD’s Move to the Cloud: Box it Up or Build New?”

Even though DoD wants to have 57 percent of apps in the cloud in five years, budget pressures could mean the agency has just 24 percent of apps in the cloud by 2020.

DoD is a Big Deal
We all know DoD has the biggest house on the block. It will account for 37 percent of all the money Federal agencies will spend on cloud computing in the current fiscal year, or $772.9 million of a total $2.05 billion, according to the Cloud Computing Caucus Advisory Group’s report.

So it’s good to keep up with our friends at the Pentagon.

See “DoD’s Move to the Cloud: Box it Up or Build New?” here. And tell us your agency’s plan for moving apps to the cloud. Does it have one? Is it better to move apps from legacy systems or build new apps in the cloud? Does that save money? Let us know what works for your agency so we can spread the word.

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

What’s Missing From FITARA: Agencies Need Revolving IT Funds

Why can’t the government successfully complete complex IT projects? This question persists whether one is talking about Healthcare.gov or the recent data breaches at the Office of Personnel Management.

The primary reason is the cumbersome way the government funds IT development. With agencies subsisting from one Continuing Resolution (CR) to the next, intermittent funding wreaks havoc on IT planning. But even if Congress consistently enacted the 13 appropriations bills needed to fund government operations every year, funding would still be a problem. That’s because funds are usually allocated in one-year increments.

The next reason government IT programs flail and fail is because agency CIOs don’t have full control and oversight of their agencies’ IT spending.

That’s why we created the Federal IT Acquisition Reform Act (FITARA). I drafted the original legislation for Reps. Darrell Issa (R-Calif.) and Gerry Connolly (D-Va.) as senior counsel on acquisition for the House Oversight and Government Reform Committee.

Now the White House is busy implementing FITARA. And with the first implementation deadline looming Aug. 15, this is a good time to take stock of what FITARA does – and doesn’t do.

The Aug. 11 FITARA Forum, featuring Federal CIO Tony Scott and his top policy and strategy deputies, is a good place to get your bearings. MeriTalk founder Steve O’Keeffe has pulled together Federal CIO Tony Scott, leading policy and strategy makers at OMB, a Federal CIO leadership panel, GAO IT expert Dave Powner and myself to cover FITARA from conception to implementation and the outlook for what’s ahead.

On that front, the fact is that the work we began is not yet finished.

One key FITARA provision that did not survive the legislative process is a funding mechanism for emerging technologies like cloud computing.

This provision would have established or enabled the use of existing Working Capital Funds to be leveraged for Federal agency expansion of cloud computing. The language mirrored language establishing similar funds in other agencies, such as at the U.S. General Services Administration (GSA), and would have specified that such funds could preserve funding for cloud service transitions for up to five years per appropriation.

This type of budget flexibility is just what agencies need to successfully migrate to innovative and more flexible models of IT to enable the Federal government to pay for IT that it actually uses, which could result in massive cost savings. It would allow agencies to renew the government’s commitment to the “cloud first” initiative.

Failing to include this provision undermines FITARA.

Vivek Kundra, our first Federal CIO, made the case for working capital funds as far back as 2010.

“The rapid pace of technological change does not match well with the Federal government’s budget formulation and execution processes,” Kundra said then. “To deploy IT successfully, Federal agencies need the ability to make final decisions on technology solutions at the point of execution, not years in advance. Agencies need the flexibility to move funding between investments or projects within their portfolio to respond to changes in needs and available solutions.”

Kundra proposed a “Revolving Capital Fund” that could be rolled over and replenished in a much more flexible manner than relying on CRs or yearly appropriations to compensate for the misalignment between IT program management and the need for detailed budget planning.

Generally, Intra-governmental Revolving Funds (IRFs), including Revolving Capital Funds and Working Capital Funds “do not receive appropriations directly,” according to GAO. “Instead, they are accounts that may receive reimbursements and advances from other Federal accounts. …The use of IRFs to fund consolidated or shared services allows agencies to benefit from economies of scale or take advantage of specialized expertise that they may not have…”

Agencies have used Revolving Funds for years. They are widely recognized as a key resource to implement shared services, such as IT, that are common across agencies. The Justice Department, Census Bureau, and Commerce Department all use Revolving Capital Funds today.

Congress should move forward now to expand FITARA, and give agencies the ability to leverage revolving funds in order to move more quickly to the cloud.

FITARA Fandango?

If you thought Fed CIOs’ dance cards were full with the cyber cha-cha, cloud can-can, and data center duck walk – it’s time to make room for some new moves. Here comes the FITARA Fandango. And, the first FITARA deadline for agencies to submit their self-assessments to OMB is August 15. It’s getting CIOs’ toes tapping inside and outside the Beltway. (more…)

Four Takeaways on Cyber

It’s a big, bad world. So what do agencies need to know that can help them improve cybersecurity? At the Symantec Symposium, these key ideas to improve security resonated with an audience concerned that they will be the target of the next attack.

1.    Take a broader view.

“Identify and protect” used to represent a standard approach to cybersecurity, said Symantec Senior Vice President and Chief Information Officer Sheila Jordan. But it’s not effective any longer, she told the Symantec Symposium recently.

“Identify and protect is where we have historically been, and for a long time that served a great purpose. But now we need to move to…‘detect, recover, and resolve’ as fast as we possibly can,” Jordan said. “I want to detect, recover, and resolve an incident before a person even knows what happened.”

2.    Build your insider threat program.

The insider threat is real, but the public sector has work to do, said Steve Smith, Insider Threat Program Coordinator at the U.S. Department of State.

“We’re nowhere near where we need to be,” said Smith.

Organizations that want to build an insider threat program should focus on what data they want to protect and then put the technology in place to keep it safe, said Government Acquisitions Chief Technology Officer Prem Jadhwani. That includes encrypting it and using two-factor authentication.

Institutions also need to understand which employees have access to the data that requires protection.

Not every data breach is the work of a malicious insider. Organizations have a harder time protecting data from well-meaning employees who unintentionally expose information or systems to risk. Well-meaning vendors can also slip and disclose data accidentally – 22 percent of data breaches last year resulted from employees accidentally making data public, while only 8 percent were the result of insider theft, according to Symantec’s 2015 Internet Security Threat Report.

3.    Leverage Continuous Diagnostics and Mitigation (CDM).
Einstein is reeling, and agencies need help. Agencies are anxious for the Department of Homeland Security’s CDM program to reach all agencies. The program now covers about half of government networks, with the goal of having full coverage by the end of Fiscal Year 2016, said Andy Ozment, assistant secretary of the DHS Office of Cybersecurity and Communication.

That’s good news.

“We have seen some significant benefits from CDM,” said Rod Turk, Chief Information Security Officer, Department of Energy.

4.    Don’t forget the data.
Data and analysis are crucial, and malware represents one of the most important pieces of information for law enforcement in a cyber investigation, Allison Tsiumis, section chief with the Federal Bureau of Investigation’s Cyber Division, said at the Symantec Government Symposium. Malware can reveal a lot of information, so law enforcement:

•    Maintains a current inventory of known malware
•    Tracks which malware threat groups use to carry out attacks
•    Reverse engineers malware once it’s identified and contained to see how it works and what it can do

Law enforcement must also understand the TTPs of cyber criminals – their tactics, techniques, and procedures – including:

•    Who the hackers target
•    When they launch an attack
•    How they carry out attacks
•    What method they use
•    What data they target

Connecting all these dots can help law enforcement achieve their goal of identifying hackers and, perhaps, capturing the bad guys. Understanding the questions law enforcement attempts to answer in a cyber investigation can help Federal agencies improve cybersecurity going forward because the questions offer guidance on how to respond following an attack.

Analytics can help agencies look at the mountains of data coming in from various sources and correlate the data to detect anamolies. Analytics can help agencies combat insider threats, external attacks, including Advanced Persistent Threats (APTs), malware, and zero-day attacks.

“I see big data as a perfect solution to solve cyber problems,” Jadhwani said.

Learn more: read Symantec’s Internet Security Threat Report or see a list of all session podcasts.

And let us know how your agency tackles cybersecurity.

Feel like sharing something Noteworthy? Post a comment or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

On Your Mark, Get Set – Are You Ready for the Federal Cyber Sprint?

If you’re involved in meeting the requirements of the 30-day Federal Cybersecurity Sprint, here’s some help from Dell Software’s Paul Christman on how our solutions can assist your agency in making real, substantive progress in the Sprint’s accelerated timeframe:

 

On Your Mark, Get Set – Are You Ready for the Federal Cyber Sprint?

By Paul Christman, VP Federal, Dell Software

In the wake of the recent OPM cyber breach, federal CIO Tony Scott recently announced a 30-day “Cybersecurity Sprint” requiring agencies to immediately take steps to improve protection of federal information and resilience of federal networks.

Tony Scott’s initiative comes in the wake of the latest battles in the ongoing cyberwar against the United States government and an alarming increase in cyber threats. In fact, a February 2015 report issued by the U.S. Government Accountability Office (GAO)found that over the past eight years, incidents reported by federal agencies to the U.S. Computer Emergency Readiness Team (U.S. CERT) have increased by 1,121 percent, reflecting 67,000 reported incidents in 2014.

The use of the word “sprint” signifies that the CIO is utilizing a methodology designed to deliver results fast. At the same time, the Cyber Sprint encompasses a wide range of critical cybersecurity elements, recognizing the need for holistic security and an active, rather than reactive, security posture. This presents agencies with a significant challenge, but one that they have the resources to address.

Within the confines of the Cyber Sprint, agencies must address four critical security efforts:

Immediately deploy indicators provided by DHS regarding priority threat-actor Techniques, Tactics, and Procedures to scan systems and check logs

As a part of the Cyber Sprint, agencies will now be required to immediately report any evidence of malicious cyber activity. Real time reporting is essential for quick remediation of cyber incidents. Luckily, today’s next-gen firewalls, coupled with insight into abnormal network activity enabled by robust identity and access management (IAM) approaches make these capabilities possible and give agencies a head start on their sprint. Dell SonicWALL offers next-gen firewalls that can correlate and present data from servers, network switches and firewalls.

Patch critical vulnerabilities without delay

Cyber criminals often have advanced resources available for cyber exploits, yet the vast majority of cyber intrusions take advantage of easily identifiable – and easily remediated – vulnerabilities. With the right tools in place, this is a simple element of the Cyber Sprint. Dell can identify and deploy patches for endpoints and servers and also provide updated virus signatures and deep packet inspection through next generation firewalls. Dell’s KACE systems management appliances enable rapid and effective patch management across heterogeneous enterprises of all sizes.

Tighten policies and practices for privileged users

Privileged users often hold the keys to the kingdom when it comes to sensitive government data. The Cyber Sprint seeks to mitigate this potential threat by limiting and controlling privileged user access. Additionally, Tony Scott has stressed the importance of tightening policies for privileged users. Privileged account management tools can help tighten these policies without prohibiting necessary access. Dell’s privileged account management offeringsallow agencies to control the resources available through privileged accounts, while also controlling, monitoring and producing reports on the activities of these individuals. Dell is the only vendor that offers solutions in each area detailed by Gartner in its Privileged Account Management Market Guide. 

Dramatically accelerate implementation of multi-factor authentication, especially for privileged users

Internal threats have been recognized as a critical security concern, often providing intruders with easy access to sensitive data. Multi-factor authentication provides an additional line of defense against external bad actors posing as qualified insiders – one that has been mandated by government for the past decade through Homeland Security Presidential Directive-12 (HSPD-12). Dell can provide hardware and software tokens for multi-factor authentication and help agencies integrate existing multi-factor authorization infrastructures with modern as well as legacy applications. Dell’s Defender multifactor authentication solution requires no dedicated server and can authenticate against already-in-place Active Directory infrastructure, facilitating this step for agencies in a hurry to get to the finish line.

Get on your mark and get ready for the sprint – Dell stands ready to help federal agencies achieve the cybersecurity improvements with which they’re tasked. Learn more about Dell’s end-to-end security offerings here:http://software.dell.com/solutions/security/

Dell also offers end-to-end solutions to address the NIST Cyber Framework. To learn more please visit: http://software.dell.com/nistframework/

WT18F?

I’m all for shaking up Fed IT. So, when Dan Tangherlini launched 18F, GSA’s internal innovation hub, he grabbed my attention. More than a year later, seemed like a good time to check in on GSA’s geek squad. The question, is the 18F experiment working – Fairytale or Frankenstein? I decided to ask around – talking to Feds and directly with 18F.

Tech Timeline?

Here’s 18F’s history – from the horse’s mouth. The Presidential Innovation Fellows – PIFs –started in 2012 – under Federal CTO, Todd Park. The goal, to bring a bunch of high-tech smarties into government and embed them with agencies for six to 12 months to tackle tech troubles – and amp up innovation. The initial cadre was 18. The second round of PIFs arrived mid 2013 – and the group grew to 40. Today, there are almost 100 at 18F.

The program’s seed funding came from GSA’s revolving capital fund. 18F will pay back that investment by selling fee-for-service projects to agencies. As the program matures, 18F explained its focus on making a lasting difference – getting roots and giving wings to engagements. PIFs are hanging in D.C. longer – the 12-month term limits are history. 18F explained that a year just wasn’t enough to really make a difference.

Tech Triumphs?

When I asked about successes, 18F pointed to analytics.usa.gov. It’s a pretty cool site that tells you in real time how many folks are visiting Federal websites – no lightning bolt, the weather service is consistently top of the pops. Cool, but not exactly transformational tech stuff that enhances fundamental government efficiency. 18F noted that Philadelphia’s showing analytics.usa.gov some brotherly love — utilizing the code to provide web visit transparency to its citizens.

Outside of that traffic-tracking site, 18F didn’t have too many more triumphs to trumpet. The spokesperson pointed to the growth of the size of 18F as a metric for success. Is bigger better?

I did speak with some other Feds, who pointed to the work/dashboard page on 18F’s site. Interesting, but difficult to map from here to groundbreaking innovation.

Tech Terrors?

However, the 411 on 18F is mixed. While Ex 18Fers sing the program’s praises, a series of Fed IT execs grumble the glossy sheen doesn’t reflect reality. They say 18F’s running amok. Agency “sponsors” don’t know where to find their PIFs or quite what they do. Folks tell of an arrogant DNA – characterizing 18F consultants as patronizing and demeaning. “Seems they think they’re smarter and treat us like we have no idea what we’re doing.” “What have they actually accomplished, beyond the website tracking thing?”

Folks also have questions about the cyber consideration – “if we didn’t have to follow the rules, we could all move a lot faster too.” “Prototypes built in minutes don’t cut it when our bacon’s on the line.”

I put these observations directly to 18F – they seemed aghast. They feel they’re super accountable. They note every agency has a 30-day-out clause. All work is structured in iterative cycles. So, if you don’t like 18F, here’s your chance to 86 them. 18F noted that agile is a leap of faith for anybody that hasn’t done it before – there’s comfort in a laying out a traditional waterfall timeline if it’s what you know. In fairness to 18F, based on GAO reports, waterfall has left much of Fed IT under water to date.

Responding to the arrogance accusation, 18F says they’re not trying to play “hero ball.” “We’re not here to tell folks that they are doing it wrong – we want to be sensitive.”

Industry has real questions too. Companies feel 18F’s competing with the private sector – leveraging an unfair advantage to shill for work inside the government.


Tech Tension?

Ironically, former 18Fers do a much better job telling the 18F story than today’s team. 18F is committed to new ways of doing things – agile, minimal viable product, open source, tech sprints, etc. Former 18Fers say that if agencies won’t embrace these principles, 18F simply won’t work with them. That might explain the perception of arrogance.

As I said, it’s a pretty confusing situation. First off, if I might be so bold, 18F could use some real PR support. That said, the tension over 18F seems to be a quarrel between the past and the future of Fed IT. Is 18F perfect? Likely not, but they’re surfacing new ideas – which has to be a good thing. The tension between traditional IT and smarty pants consultants is shake things up – and ultimately that’s good for Fed IT efficiency. We clearly need increased accountability and transparency in the equation – how and where is 18F delivering value – how much and at what cost? Is there an expiration date on the experiment?

It’s impossible to talk with everybody who’s had experience with GSA’s geek squad – so please write in with your feedback.

Until we hear more from you – it’s WT18F? TBD…

Is CDM the Prescription for What Ails Agencies?

Following the historic Office of Personnel Management (OPM) hack and the theft of data from the Internal Revenue Service (IRS) – for the second time in a year – agencies are searching for a long-term cure to cybersecurity woes.

Continuous Diagnostics and Mitigation (CDM) could be the medicine they need. A panel of CDM experts at the recent Symantec Government Symposium said CDM is one of the key proven defenses against pervasive threats.

“We have seen some significant benefits from CDM,” said Rod Turk, Chief Information Security Officer, Department of Energy.

Sounds like CDM may be just what the doctor ordered.

Moving Ahead
Nearly two years after its August 2013 launch, CDM remains in Phase 1 (which focuses on endpoint security through hardware and software asset management, configuration settings, and vulnerability management).

CDM may be “a few months behind schedule” due to funding fights, said Christopher Cummiskey, a former acting under secretary for management at the Department of Homeland Security (DHS).

Andy Ozment, assistant secretary of the DHS Office of Cybersecurity and Communication, said in April DHS just needs time to get the program implemented and the CDM will fully cover Federal systems by the end of next year.

“We think we’re in good shape,” he said.

DHS on May 7 awarded a $39 million contract to Booz Allen Hamilton, which will – along with its partners – provide monitoring services for OPM and the departments of Energy, Interior, Transportation, Agriculture, and Veterans Affairs.

Mark Kneidinger, Senior Advisor, Federal Network Resilience Office, DHS, said the schedule for the rest of the agencies under the CDM program is on track, with the next wave of awards likely to come in the fourth quarter of this year.

No News is Good News
Agencies realize that CDM will help keep agencies out of the news, said Grant Schneider, CDM Oversight Lead, Office of Management and Budget.

“CDM is really giving us a level of foundational and fundamental situational awareness about our systems and our environment so that we can have much more mature risk conversations with the mission owners,” Schneider said. “Deputy secretaries are very interested in cybersecurity. They might not have been a couple years ago, but Target, Home Depot, Sony Pictures, and all the government [breaches] — they kind of all realize, ‘That could be me on the front page of the paper.’ So they’re interested in having the conversation.”

They’re viewing CDM as a cyber flak jacket.

Paradise by the Dashboard Light
But more than a flak jacket, CDM is a window on your cyber security. Kneidinger said DHS will begin moving dashboards to some departments and agencies as soon as next month, giving them real-time visibility into their systems.

Early next year, DHS and OMB will launch a Federal dashboard, Kneidinger said. Vendors will connect the department and agency dashboards to the Federal dashboard, providing data and trends.

“We’re starting to move forward. The implementation activities, the dashboards are ready to come out. That’s the exciting part. We’re geared up for it,” Kneidinger said.

Phase II of the program will address identity, credentials, and access management, writes Aaron Boyd in Federal Times.

But the acquisition cycle has not been formalized. Phase II remains a work in progress, Kneidinger said.

Will CDM move fast enough to allow agencies to stay ahead of the next cyber threat? Is your agency eager to put CDM to use?

Learn more: Listen to the full discussion on CDM, read the complete Internet Security Threat Report, or see a list of all session podcasts.

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

Burnin’ Down the House

Smokey the Bear says, “Only you can prevent wildfires.” Today, that wildfire is the OPM breach. Yesterday it was IRS. The day before that, it was Snowden.

Tomorrow, it’ll spark up somewhere else.

Federal cyber pros are sounding the alarm. They are spending too much time fighting cyber fires. The old approaches and point products aren’t working – agencies need real change and a holistic approach to fight today’s threats, as well as new challenges smoldering for tomorrow.

Fanning the Flames

According to recent research, 93 percent of Federal executives indicate cyber defenses need significant improvement, but only 56 percent are assessing their networks daily to analyze and address security risks.

Einstein doesn’t look so smart right now – understand the intrusion detection system held the door open at OPM. CDM wasn’t enough. Fire likes oxygen – how do agencies choke the flames?

Dousing the Fire

An ounce of prevention is worth a pound of cure – and most cyber pros agree that an effective cyber posture is a combination of people, processes, and tools.

Many are turning to the NIST Framework for Improving Critical Infrastructure Cybersecurity as a comprehensive strategy to prevent the fire drills. The framework was developed in a year-long, collaborative process between industry, academia, and government stakeholders. It’s designed to work in any enterprise – public or private.

Want to learn more about the NIST Framework? Check out the abridged version. This Framework assessment tool helps agencies determine your cyber security capabilities and set goals for your future defense. NIST suggests organizations use the Framework to:

Conduct a basic review of cyber security practices
Establish or improve a cyber security program
Communicate cyber security requirements to stakeholders
Identify new or revised references for solutions
Stop, Drop, and Roll

Don’t forget to test your smoke alarms. And if they go off, don’t ignore them. This said, alarms and point products won’t keep you safe, and won’t keep you off the front page of the Washington Post. Check out the Framework to jump start your comprehensive, integrated cyber defense. Smokey’s smiling.

Tea with Tony?

Not sure if he’s a coffee or tea drinker, but I do know Tony Scott’s joining us for breakfast this Wednesday at the Cloud Computing Brainstorm at the Newseum. The Federal CIO will set the table for the half-day cloud chow down with his morning keynote address.

If you’ve got an appetite for cloud, Wednesday’s Brainstorm’s a tapas feast – nine tasty tongue tempters and untethered by 2:00 p.m. to trounce the traffic. With 600 govies registered, you’d better arrive early to get a seat at the table.

Here’s the menu:

1st Course(s) – your pick. It’s FedRAMP Fast Forward for industry. Working session on how to increase FedRAMP efficiency. Or, for the govies, join us for the Data Center Exchange FITARA implementation planning breakfast with Ben Rhodeside, tech lead from Congressman Connolly’s office, and Ben Sweezy from OMB.

2nd Course – Yours truly – preview of the new Gov Cloud Shopper functionality

3rd Course – Tony Scott. What’s new in Federal cloud – with a side of FITARA implementation planning

4th Course – Building the Cloud Business Model: ITA/Commerce, EPA, FCC, and USDA

5th Course – Trusting the Cloud: GSA, NIST, and Air Force

6th Course – Hybrid Future: Army, IRS, and ITC

7th Course – Anil Karmel from C2 Labs and the NIST Cloud Security Working Group

8th Course – Cloud Computing Caucus Advisory Group – industry perspectives

Dessert – NIST Cloud Security Working Group meeting – featuring a keynote from Jim Reavis from the Cloud Security Alliance

We’re embracing a progressive theme for the party – the Cloud Caucus Don’t Be a Box Hugger report provides our backdrop. MeriTalk’s also releasing new research on DoD’s Cloud Deployment plans.

Breakfast with Tony Scott and all of Uncle Sam’s best cloud chefs. Make your reservation now. See you Wednesday – I’d arrive hungry and early.

Does Anyone Have Secure Access Figured Out?

Nothing gets headlines like a data breach and nothing protects against breaches like multi-level authentication.

The challenge is balancing security with convenience and cost. It’s not that it’s impossible to keep all your data locked up and secure. It is. It’s that making it secure and accessible is so difficult.

“Why is identity such a complex problem?” asks Nico Popp, Symantec’s Vice President, Information and Identity Protection told a gathering at the Symantec Government Symposium recently. “Fundamentally, it’s difficult because you have to think of identity (authentication) in three dimensions.” Those include security, cost, and user experience.

What works in one circumstance won’t work in another. People have different expectations for security based on the kinds of information potentially at risk.

Paul Hunter, Deputy Chief, Biometrics Division, U.S. Department of Homeland Security’s Citizenship and Immigration Services, collects fingerprints from people applying for citizenship. Future citizens are willing to give up that personal biometric data because of the payoff at the end of the road. But would users of e-commerce sites be willing to go so far?

Pointing to an iPhone, with its built-in finger-print sensor, Hunter suggested that if it were convenient enough, consumers might indeed be willing.

Financial firms, meanwhile, depend on knowledge-based authentication — confirming someone’s identity and granting access by asking questions that only they can answer because they are specific to them, like who was your favorite teacher? That works well for the financial services industry, said Steve Lazerowich, Director, Cybersecurity Solutions, U.S. Public Sector, Hewlett Packard. But when there’s a breach, companies risk the exposure of the personal data of a substantial number of users, and collecting that personal data could arm hackers with the information to commit more fraud.

“What do you do at that point for that individual who’s had their personal information…compromised?” Lazerowich asked.

Deb Gallagher, Defense Manpower Data Center Special Advisor, Department of Defense, said convenience was set aside when the Pentagon adopted the Common Access Card for network access 10 years ago. But it was worth the sacrifice: The Defense Department immediately saw a 46 percent reduction in successful intrusions.

“It’s not cheap, and sometimes it’s not easy to use,” Gallagher said. But it works.

The New, New Thing?
Facial recognition and retinal scans remain potential opportunities in the future. HP’s Lazerowich said he knows of one firm that’s trying to use the cameras embedded in laptops and desktop monitors to scan users’ faces when they log in, and to identify if anyone is looking over their shoulder.

If the camera detects another person in the field of view, it terminates the session to prevent the second person from stealing log-in information.

How Much Authentication is Enough?
What does the future hold? Mike Garcia, Deputy Director, National Strategy for Trusted Identities in Cyberspace at the National Institute for Standards and Technology (NIST), suggests that standards need to be flexible.

“One of the things we need to avoid is tricking ourselves into believing we always need strong authentication,” Garcia said. “It’s about figuring out when the strength profile matches the strength of authentication.”

Convenience over Security
No matter what agencies or organizations do to improve security, they can’t always anticipate how their employees or users will respond.

Google tried to give away strong authentication to Gmail users to improve security, Popp said.

“It failed miserably because consumers will never trade convenience for security,” he said. “The extra step of adding a one-time password” was too high a hurdle. “People don’t want to do it.”

At NIST, Garcia is trying to help develop standards that help answer that problem, and help agencies and private industry see that the more information they collect to ease authentication, the more risk they ultimately take on should they someday suffer a breach.

What steps does your agency take? Are they effective? Let us know what works and what doesn’t.

Listen to the full discussion on secure information access, read the complete Internet Security Threat Report, or see a list of all session podcasts.

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

FedRAMP Fiasco – FITARA Forward?

Action packed this week.  FedRAMP mass confusion.  Capitol opportunity to get serious about FITARA.

FedRAMP Fiasco?

NextGov reports GSA’s making FedRAMP optional.  FedScoopreports on OMB’s draft policy revisions – unclear as yet what this means for FedRAMP.

But back to GSA’s comments – two factors here.  First, the FedRAMP PMO says it’s drowning in rubbish submissions from CSPs.  Babysitting poor submission’s sucking up PMO bandwidth and choking off the supply of certified CSPs.  But, if CSPs don’t need to get FedRAMP to win deals, merely to say they’re in process, there’ll be a whole lot more incomplete and poor submissions on the way to the FedRAMP PMO.  Second, what smart CSP’s going to spend the $4-5 million – not to mention the anguish of the exercise – to go through the FedRAMP process, if it’s not required?  One additional thought.  GSA says it’s concerned about limiting competition.  Doesn’t FedRAMP limit competition by design?

Think GSA needs to reconsider its position.  It’s not just the vendor community – the Hill and GAO sitting up and paying attention.

Guessing the FedRAMP Fast Forward meeting at the Cloud Computing Brainstorm’s going to be a humdinger.

FITARA Forward?

Heads up, there’s a little publicized Oversight and Government Reform IT Subcommittee hearing on the implementation plan for FITARA at 2:00 p.m. EST on June 10th.  Witnesses Tony Scott, OMB; Dave Powner, GAO; and Richard Spires, former DHS CIO – and long-time FITARA champion.

We’re all curious to see how this plays out.  The fact that appropriators no funded Digital Services, makes you think the Hill’s serious about putting some muscle behind FITARA.  Some see Digital Services as an end around some CIO shops.  Here’s a wish for the hearing – hoping that we institute a FITARA scorecard.  KPIs:

-Cost savings

-Percentage of projects delivered on time

-Focus on incremental approach – percentage of projects scheduled for delivery within six months

-Percentage of IT contracts signed off on by the CIO

-Data center efficiency metrics

FedRAMP Fix?

Now for the dismount – let’s finish as we began with FedRAMP.  It’s ironic that almost a year to the day, after VanRoekle’s June 4 mandatory FedRAMP-compliance deadline came and went – like Obama’s line in the sand in Syria – even GSA is questioning the program’s raison d’être and fundamental viability.  The statistics say it all – this time last year, there were 16 FedRAMP ATO’d CSP offerings – from 13 vendors.  Today, there are 36 – from 29 vendors.  Of those ATO’d CSP offerings, 17 came through the FedRAMP PMO and JAB process – 16 from agency the FedRAMP process.  A year ago, there were 11 CSPs in the GSA JAB pipeline.  Of those CSPs in the pipeline, four ade it through the process in the last year.  The remaining seven are still in the pipeline.  No matter where the ATOs came from, a total of 36 certified CSP offerings – from 29 vendors – is not nearly enough after more than three years.

The FedRAMP Fast Forward group met on Wednesday to talk about FedRAMP fixes.  It’s too early to turn in the papers, but here’s a look over the shoulder at some early suggestions.

Build a capacity and through-put model for the FedRAMP PMO and JAB process based on today’s resources.  Publish specific metrics on how many CSPs the FedRAMP PMO and JAB   can process in a year.  At each phase of the process, state the FedRAMP PMO and JAB SLAs to CSPs from submission to response.  This will take the magic out of the machine and allow us to measure performance and allocate resources appropriately.  I hear your cries. What if the CSP submissions are rubbish – how’s the FedRAMP PMO supposed to meet its SLAs?  Try this on for size – if the submission is materially deficient – and we need to quantify that – then the CSP is disallowed from resubmitting for one year.  Tough love – and lawyers will get involved.  But we need some more fiber in this diet.

Watch this space for more recommendations from the FedRAMP Fast Forward.

Hope to see you at the Cloud Computing Brainstorm on June 17th.

 

Feds on the Move

Cubicle farms are dying. Where can I send flowers?

We can work anywhere, but it takes IT smarts to ensure that an increasingly mobile workforce has secure access to whatever it needs, whenever it needs it.

Managing the mobile enterprise is critical, and it’s the focus of next week’s Citrix Mobility 2015 Government Summit, bringing together experts for a deep dive into enterprise mobility management – from mobile device management to secure network access and data security.

Beyond E-Mail
Mobility isn’t just a perk. It’s a prerequisite for getting more work done faster.

In fact, the first goal of the Federal government’s digital strategy is to “enable the American people and an increasingly mobile workforce to access high-quality digital government information and services anywhere, anytime, on any device.”

“Always-on” and “always connected” have become routine. It’s no longer about receiving and sending e-mail from anywhere. It’s also about having access to the documents, data, and applications workers need instantly, without having to return to their desks and without having to jump through hoops.

IT Heavy Hitters on Deck
Howard Schmidt, who served as Special Assistant to the President and the Cybersecurity Coordinator for the United States, will provide the keynote at the Citrix summit. The White House will send the inestimable Lisa Schlosser, who serves as serves as the Deputy Administrator, Office of E-Government and Information Technology, Office of Management and Budget, Executive Office of the President and Deputy Federal Chief Information Officer, to discuss the Federal Information Technology Acquisition Reform Act (FITARA).

Don’t miss the draft guidance on changes to FITARA.

The People Have Spoken
Telework is the original mobility initiative, and it continues to gain favor as it moves from concept to mainstream reality.

In 2014, 29 percent of Federal workers participated in telework programs, up from 26 percent in 2013 and 25 percent in 2012, according to the Office of Personnel Management’s Federal Employee Viewpoint Survey.

Technology is no longer much of a barrier. Among those who don’t telework, 5 percent said that’s because of technical issues, down from 6 percent in 2013 and 6 percent in 2012.

Down on the Farm
At the U.S. Department of Agriculture, our friend and fellow Iowan, Secretary Tom Vilsack, said increased telework has allowed $18 million of cost avoidance in transit subsidies to Agriculture Department employees.

That’s something to moo about. Maybe Secretary Vilsack can find a new use for all those empty cubicle farms popping up at Ag and at other agencies.

How is your agency doing? Does it have a progressive mobility initiative? Let us know. And let us know how your agency can improve mobility for its workforce.

The Citrix Mobility 2015 Government Summit is scheduled for Monday, June 8. Start the week off right by registering here to discover the best mobility strategies, meet interesting people, and hear some great new ideas.

alt

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

FedRAMP Fast Forward?

Forget tuning in for the Indianapolis 500 this weekend.  All eyes trained on the Great FedRAMP CSP Acquisition 500 right now.  Smaller companies that pioneered the FedRAMP approval process are selling quicker than Express Lane traffic on the Beltway.  EMC’s eating VirtuStream.  CSC acquired Autonomic Resources.  QTS quaffed Carpathia.  And, we’ve only in the first lap.  We’re going to see a lot more of the FedRAMP frontrunners lapped up as the IT industry giants realize they need FedRAMP – but flinch from the traffic, complexity, and cost of the certification process.  What’s the future of Clear Government, CTC, EconSys, SecureKey, Vazata, and more?

Running Into Traffic

The Cloud Computing Caucus Advisory Group annual report, Don’t Be a Boxhugger tells us, as of May 2015, just 35 products were certified as FedRAMP compliant, with another 40 at one stage or another in the review process, and many, many more waiting to engage in certification.  According to CSPs, the average cost to complete FedRAMP certification is between $4 million and $5 million.  It takes around 18 months to get through the process.  In April 2014, 24 CSPs were awaiting certification. One year later, 16 of those same CSPs were still in the pipeline awaiting approval according to the FedRAMP OnRAMP. Each FedRAMP certification submission typically entail 1,000 pages of technical and legal documentation.  It’s the importance of the certification to Federal agency buyers and the complexity of the process that’s fueling the FedRAMP CSP buying race.

Inside Lane?

As more of the bigs jump into FedRAMP, it’s going to change the feel of FedRAMP.  Today, it’s a cottage industry, that trades on relationships.  Companies in the pipeline are more concerned about managing relationships with the FedRAMP PMO – so they can cash in on their certifications.  Many of those companies are less concerned about how FedRAMP works as an operating model, the costs associated with maintaining their ATOs, and broader government-wide adoption rates.  Too many that have made it through the process see the program’s complexity as an effective barrier to entry that wards off competition on the track.

Oil on the Track?

A host of questions hang over scalability of the FedRAMP process – how can the program office manage the deluge of new CSPs that want to get through the process?  We understand that the FedRAMP PMO currently spends as much time and money maintaining ATOs for the handful of CSPs already through the process – which means the program cannot scale.

Further, word is CSPs are running into challenges with the alternative agency route to FedRAMP certifications – as those agencies are bristling at the cost associated with managing those certifications.  How can the FedRAMP PMO manage the volume without adequate funding?  If there aren’t enough cloud options, how’s the government supposed to move to the cloud?  The requirement to move to FedRAMP Rev 4 raises additional questions for industry and government alike.

FedRAMP Fast Forward

Industry wants a front seat in FedRAMP.  That’s why MeriTalk, working collaboratively with the FedRAMP PMO at GSA, is hosting a new industry working group.  FedRAMP Fast Forward provides a venue to support, inform, and accelerate FedRAMP and broader cloud adoption across government.  The group’s structured in three workstreams:

1. Technical Standards and Process

2. Rules, Policy, Interagency Collaboration, and Communications

3. Training, Education, and Transparency

Interested in learning more?  Download the working notes from the kick-off meeting or drop a line tofedrampfastforward@meritalk.com.  The group will host a breakfast meeting at the MeriTalk Cloud Computing Brainstorm on June 17th.

And speaking of traffic, the Brainstorm features a morning keynote by Tony Scott, NIST Cloud Cyber Security Working Group session. Cloud Computing Caucus Advisory Group panel, as well as theFedRAMP Fast Forward session – so it’s going to be bumper to bumper at the Brainstorm.

Trouble on the Inside

Snowden and Manning introduced the world to insider threats. Not only do we know what that means now, we also understand how difficult it is to stay ahead of such threats.

But with the expansion of mobile technologies and increasingly sophisticated threats – both inside and outside – the whole nature of cyber defense is transforming before our eyes. What worked a short while ago can no longer be expected to do the job.

Guarding the Perimeter Won’t Cut It
“Identify and protect” used to be the standard defense, notes Symantec Senior Vice President and Chief Information Officer Sheila Jordan. But that doesn’t represent an effective approach any longer, she told the Symantec Government Symposium recently.

“Identify and protect is where we have historically been, and for a long time that served a great purpose. But now we need to move to…‘detect, recover, and resolve’ as fast as we possibly can,” Jordan said. “I want to detect, recover, and resolve an incident before a person even knows what happened.”

In the same way, cybersecurity is no longer just about guarding the perimeter. In fact, it’s not even clear where the perimeter is any longer.

Crumbling Walls
The rapid growth of mobile devices and the growing phenomena of the Internet of Things are expanding exponentially both data collection and the ability to access it. More data and more access points make security more difficult.

“The four walls of an enterprise have crumbled,” said Jordan. “There are no four walls anymore. So the data is traversing… in and outside the firewalls, with the devices, back into the devices, oh, and I forgot to mention apps and cloud. So I don’t think we have a choice but to figure out how we’re going to have end-to-end security architecture and how that’s going to traverse around the data so that ultimately we’re protecting that data (from) inside and outside threats.”

Introducing Analytics
Government Acquisitions Chief Technology Officer Prem Jadhwani agreed. Jadhwani, who joined Jordan at the Symantec Government Symposium, said analytics can help organizations look at the mountains of data coming in from various sources and correlate the data.

“I see big data as a perfect solution to solve cyber problems,” he said.

But when?

“It’s happening faster than you think,” Jordan said.

That “Oops” Moment
Not every data breach is the work of a malicious insider, of course. Organizations have a harder time protecting data from well-meaning employees who unintentionally expose information or systems to risk. Well-meaning vendors can also slip and disclose data accidentally.

“Insider threats aren’t just your employees,” Michael Dent, Chief Information Security Officer, Fairfax County, Va., said. “They also are your contractors, your vendors, your volunteers, potentially, that come in and work for you. We had a vendor who took data from the county on a USB, very innocently… and he ended up exposing some county data for over two years on an unsecured file share from his company.”

In fact, 22 percent of data breaches last year resulted from employees accidentally making data public, while only 8 percent were the result of insider theft, according to Symantec’s 2015 Internet Security Threat Report.

Jordan calls unintentional data breaches “a huge learning opportunity.”

Where to Start?
The public sector has a long way to go to build mature insider threat programs, Steve Smith, Insider Threat Program Coordinator at the U.S. Department of State.

“We’re nowhere near where we need to be,” said Smith.

Organizations that want to build an insider threat program should focus on what data they want to protect and then put the technology in place to keep it safe, said Jadhwani. That includes encrypting it and using two-factor authentication.

Institutions then need to understand which employees have access to the data that requires protection.

“Look at your privileged users,” said Jadhwani. “See what they are doing. Rather than waste time on who’s trying to come from outside, let’s look at where our crown jewels are, and let’s focus our attention there. I would say it doesn’t stop with technology. I have an acronym for that – BEST. ‘B’ is the background investigation, ‘E’ is employee behavior, ‘S’ is situational awareness, and ‘T’ is training. If you combine all the policy, tools, and technology together… it will work, and it will pay dividends.”

Learn more: Listen to the full discussion on insider threats, read the complete Internet Security Threat Report, or see a list of all session podcasts.

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

Digital Services DOA?

One of the three White House IT priorities called out in the 2016 budget request, Digital Services may be the first IT casualty of partisan politics. A series of agencies have reported that their 2016 budget pass backs include a big goose egg in funding for Digital Services. We’ve asked the question of OMB – seems that’s the case. The next question – what’s the future for Digital Services with no funding?


Whistling Dixie

It’s no surprise that Republicans don’t like the idea of the Federal government getting into the state and local business – providing services directly to citizens and growing the Federal budget footprint. Let’s face it, the launch of healthcare.gov was certainly diseased.

Each cabinet-level agency was directed by OMB to ask for $9 million for Digital Services. These agencies built out plans for how to implement those Digital Services. Right now, they’re wondering if that whole effort was a huge waste of time and money.

Self Service

If Digital Services faces a dollar drought, what’s the path forward? Will OMB find additional funding from another budget bucket? Should agencies focus on self-funding models – perhaps charging America a fee-for-service model? Will this drive a series of no-cost contracts? Dozens of questions out here on the digital frontier. Here’s hoping Digital Services makes it out of the neonatal intensive-care unit.

Our Cloud Learning Curve Continues — and That’s a Good Thing

Lots of people are talking about cloud computing. So listen carefully.

Even if the term is a misnomer, cloud computing is a big deal. Here’s the thing – organizations can do anything in the cloud that they can do on-premises. So why are Federal agencies still investing just a fraction of their IT budgets on cloud computing?

DevOps Trending Up
A new study by MeriTalk, “The Agile Advantage: Can DevOps Move Cloud to the Fast Lane?” helps connect the dots. Agencies want to move more quickly, and 66 percent say they need to move IT services to the cloud faster to meet mission and constituent needs. But it’s not easy. However, some Feds are beginning to see DevOps as an option.

DevOps is an approach that brings software engineering, quality assurance, and IT operations together as an integrated team to collaboratively manage the full application life cycle.

By the Numbers
Just 22 percent of Feds are very familiar with DevOps today, but 60 percent say they can see DevOps in their agency’s future.

That’s not all – 63 percent say DevOps will speed up application delivery and migration, and 68 percent see DevOps as a viable path to improve collaboration between IT development, security, and operations teams.

Speeding Up with DevOps
DevOps is about speeding up software development.

Conventional development cordons off software developers from IT operations and quality assurance. Each team does their thing serially, one after the other. DevOps speeds everything up. It’s automated and collaborative. Management consultant Accenture believes DevOps can result in a 50 percent increase in speed to market, according to its “DevOps: Services Overview.”

The Secret is Out
So here’s a question – can DevOps help agencies migrate to the cloud faster?

Maybe DevOps and cloud computing go hand in hand. Like peas and carrots, apple pie and ice cream, or B.B. King and blues (RIP, B.B.). According to the new study, Federal agencies are just starting to adopt DevOps, but the majority sees it in their future.

Read the full report about DevOps to learn more about how it can help Federal agencies.

And learn more about Federal cloud.

Is DevOps in your future?

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

Cloud Christmas?

Chances of snow – remote. But, this week was Cloud Christmas for agencies focused on IT transformation. Like a silicon Santa, Congressman Gerry Connolly unwrapped the Cloud Computing Caucus Advisory Group annual report, “Don’t Be a Box Hugger,” on the Hill on Monday. Based on interviews with CIOs and CFOs, Box Hugger divides agencies into a naughty/nice list of sorts. Pioneers – the early adopters who blazed the trail to the cloud. Fence sitters – who have dipped a toe into the cloud, but aren’t ready to make a mainstream transition. And, Box huggers – the anti-cloud crowd, clinging to their own hardware, software and rising cloud anxieties.

The report provides a sanity check on what’s really happening in Federal cloud – and regrettably, what’s not. Importantly, it offers a rationale to explain the movement or lack thereof, in the marketplace, and makes recommendations on the path forward. Three big takeaways:

  • Tell the Truth: OMB should set and enforce deadlines as well as increase transparency on the government’s actual cloud spend
  • Change the Game: Provide additional funding for FedRAMP, streamline acquisition and budgeting, provide incentives and reward success, while nurturing public-private collaboration
  • Think Bigger: Uncle Sam has already picked the low-hanging cloud fruit, so now it’s time for agencies to identify how the bigger, more challenging cloud solutions can help save money, speed development, improve services, and increase mission effectiveness

And, if you want more data and analysis, Katell Thieleman, Gartner’s Federal lead, took the podium after Gerry Connolly. Playing Santa’s helper, she shot down five myths of federal cloud, a foretaste of what you could read in her new report on cloud in Federal IT – a lot of parallel themes. That and “Box Hugger” are two must-read resources for folks serious about change – you’ll see these reports referenced all around the Beltway.

But Wait, There’s More

We’ve only unwrapped the first gift. The elves at MeriTalk have been busy – we rolled out three significant new initiatives this week to improve the cloud forecast. If you don’t have time to read the book, you can watch the movie .

Government Cloud Shopper

Developed with the government – big thanks to Greg Capella at DHS, the team at GSA cloud, and many more – GCS is a free tool that takes the mystery out of cloud acquisition. This menu-driven “build a bear” for cloud provides cloud migration cost estimates based on FedRAMP-compliant CSP prices, professional services costs, and migration set-up expenses. That’s the full cost picture, not just the cloud services cost. It then allows agencies to go to the next level – design requirements – and submit them to the cloud GWAC procurement shop of their choice – GSA, NASA SEWP, DHS, Interior, etc. Change your requirements to see the cost difference between 99 percent and 99.99 percent uptime. What’s the difference between a naughty and nice cloud? Let us show you.

FedRAMP Fast Forward

As goes FedRAMP, so goes government cloud. It’s a consistent, central theme in Box Hugger. You’ll read the report, so I won’t get into detail here. That said, unless FedRAMP accelerates, there’s significant concern that it will collapse under its own weight. This isn’t just a government problem – industry gets it too. Especially the CSPs and 3PAOs that have invested millions in the certification process. That explains the launch of the new FedRAMP Fast Forward industry working group, comprised of FedRAMP CSPs and 3PAOs. Look for bright ideas – and collaboration with government – on how to enhance the value and efficiency of the FedRAMP process and reduce the costs of achieving and maintaining certifications. Second meeting at the Cloud Computing Brainstorm on June 17th.

FedRAMP 411

Is FedRAMP at the top of your Cloud Christmas list? Then subscribe to the new FedRAMP 411 news source. All the breaking news, profiles of agency successes, and updates from the program offices. That plus status on all FedRAMP CSPs and 3PAOs. If it’s FedRAMP, it’s on FedRAMP 411.

Second Christmas?

And, as if this week’s not enough, mark your calendar for a second helping of Cloud Christmas on June 17th at the MeriTalk Cloud Computing Brainstorm. First up, FedRAMP Fast Forward breakfast meeting. Then, Tony Scott kicks us off with the morning keynote. Then NIST Cloud Cyber Security Working Group. The Cloud Computing Caucus Advisory Group is hosting an industry panel. And, of course, a star-studded program of Federal cloud practitioners sharing their agencies’ experiences in the cloud.

There’s a jingle in the air this Spring – it’s a Merry Cloud Christmas in May.

Cyber Intelligence: Adding Up the Threat Landscape

Numbers don’t lie. These numbers from Symantec’s Internet Security Threat Report are scary, but they describe what’s at stake in the never-ending fight against hackers. Last year:

  • Attackers targeted five out of six large companies, a 40 percent increase over 2013
  • 24 zero-day vulnerabilities were discovered
  • 317 million pieces of new malware were created

That’s just the tip of the cyber threat iceberg. It all adds up to a big problem.

Making Data Count
So how does law enforcement get ahead of the attackers?

Data and analysis. One of the most important pieces of information for law enforcement in a cyber investigation is the malware, Allison Tsiumis, section chief with the Federal Bureau of Investigation’s Cyber Division, said at the Symantec Government Symposium. Malware can reveal a lot of information, so law enforcement must:

  • Maintain a current inventory of known malware
  • Track which malware threat groups use to carry out attacks
  • Reverse engineer malware once it’s identified and contained to see how it works and what it can do

Law enforcement must also understand the TTPs of cyber criminals – their tactics, techniques, and procedures – including:

  • Who the hackers target
  • When they launch attacks
  • How they carry out attacks
  • What method they use
  • What data they target

Connecting all these dots can help law enforcement identify hackers and even capture the bad guys. Understanding the questions law enforcement asks in its cyber investigations can help Federal agencies better understand how they should respond following a cyber attack.

Don’t Count Out the Good Guys
Stopping attacks and identifying the criminals isn’t easy, but methodical data collection and analysis has helped.

The FBI gathered enough data to pinpoint which unit of the Chinese People’s Liberation Army (PLA) was responsible for cyber attacks that led to charges being filed against five people in May 2014. The indictment named members of Unit 61398, which was publicly identified in 2013 as the Shanghai-based cyber unit of the PLA.

“That was really key, to be able to drill that far in with our investigation techniques to get that distinct of an identification of the threat actors. Not just the threat group, the Chinese government, but drill down to their actual location,” Tsiumis said.

The Justice Department’s indictment charged the PLA members with hacking into the networks of Westinghouse Electric, the United States Steel Corporation, and other companies. Jeff Brannigan, a special agent with the Department of Homeland Security’s Immigration and Customs Enforcement, said at the Symposium that the theft of intellectual property, like the thefts carried out by the PLA, “is a pervasive crime that is only going to grow in volume and severity.”

Jason Brown, Assistant to the Special Agent in Charge in the U.S. Secret Service’s Criminal Investigative Division, said that agency’s efforts have allowed it to determine that Russians in former Soviet states represent the leading perpetrators of cyber attacks against U.S. financial institutions.

“There are a lot of other nationalities and actors that are involved in computer crime,” Brown said at the Symposium. “The Secret Service views specifically those attacking our financial infrastructure seem to be mostly emanating from Eastern Europe or are Russian-speaking individuals.”

Listen to the full discussion on cyber intelligence, read the complete Internet Security Threat Report, or see a list of all session podcasts.

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

Hurd on the Hill, Scott in the Silicon, Spring in the Air

Considering we’re getting down to the dog days of the administration – and CIOs are jumping overboard quicker than you can say FITARA – these are surprisingly heady times in government IT.  We’ve got a new tech-savvy leader on the Hill in Congressman Will Hurd (R-Tx).  We’ve got a new world-class Federal CIO with operational oil under his fingernails in Tony Scott.  And, Amazon’s recent earnings just proved that cloud is not only viable and sustainable – it’s profitable.

Hurd on the Hill – Getting Down to Business

So, what can we expect for the balance of 2015 – and over the horizon in 2016?  In a word, pragmatism.  That and a real focus on how to actually produce meaningful movement forward.  Don’t think Tony Scott’s going to try to leap any buildings in a single bound – but rather nurture the Fed IT workforce and look to stay the course of cloud transformation with a strong eye on cyber security.  Now, everybody’s watching for the IT hearing schedule on the Hill and listening hard to the auditors at GAO – we all want to know how and what we’ll measure.  It’s not about forcing change, it’s about common-sense IT transformation that really moves the ball forward in delivering quantitative improvements in IT efficiency.

Scott in the Spotlight – Focus on Getting IT Done

Want to hear Tony Scott’s vision for the road ahead?  You can join us at the MeriTalk Cloud Computing Brainstorm on June 17th to listen to the man in the driver’s seat talk about Cloud, Cyber Security, the workforce – all against the backdrop of FITARA implementation plans that Tony released yesterday.  What a great opportunity to tie everything together in the context of this new CIO empowerment law.  Congratulations to OMB for meeting a deadline – evidence of the dawning of a new era.

Cloud Caucus Report – Don’t Be a Box Hugger

All this, and the Cloud Computing Caucus Advisory Group meeting on May 11th on the Hill.  We’ll hear from Congressman Hurd’s partner in progress, Congressman Gerry Connolly – and who knows, perhaps Hurd too?  CCCAG will roll out its Federal CIO and CFO study – Don’t Be a Box Hugger – the first comprehensive review of the state of cloud in Federal IT.  Katell Thieleman, Gartner’s Federal fashionista, will step up to the podium to provide that critical analyst insight – and, we understand, offer tidbits from her new government cloud study.  That’s must see IT.

Catch Up Over a Cocktail

Too much to take in via the written word?  Then join us next week, Thursday, May 7th, at the State Theatre in Falls Church, to discuss what’s shakin’ and the path ahead as O’Keeffe & Company and 300Brand celebrate 18 years serving the government IT community.  Register here.  Rumor has it, we’ll see celebrity appearances from Richard Spires and other Federal IT aristocracy.

More as this exciting story unfolds.  Look forward to seeing you at the Cloud Brainstorm, on the Hill, and at the State Theatre.  Don’t they say that Spring is a time for revitalization?  It is in Federal IT.

An Honest Conversation about Cyber

Honesty is the best policy, right?

That’s why honesty has its own day – tomorrow is National Honesty Day. No lie. Funny that it comes at the end of the month that begins with April Fool’s Day. Or maybe that’s ironic…

So let’s be honest. Cyber’s all the rage. So is big data.

While some agencies are using analytics to improve cyber security, many are not, according to a new report from MeriTalk, “Go Big Security.” Or they don’t know how best to use the scads of data they collect to improve cyber security.

Numbers Don’t Lie
All agencies struggle with cyber security. They struggle with protecting data and networks. Remember this line from the White House’s annual FISMA report in February?

“Federal agencies reported nearly 70,000 information security incidents in FY 2014, up 15% from FY 2013.”

Agencies are investing in security technologies, deploying network analysis and visibility solutions, and investing in skills training for personnel. But big data isn’t among the go-to solutions.

While 86 percent of cyber security professionals in Federal, State and Local organizations believe big data analytics would significantly improve their organization’s cyber security, only 28 percent are actually leveraging big data to identify and defend against hackers.

In many cases, agencies have the data but they don’t know what to do with it. According to the report, 68 percent of government cyber professionals say their organization is overwhelmed by the volume of security data.

There’s also a strategic issue at play – 76 percent of cyber security professionals say their security team often is more reactive than proactive.

Tell Me the Truth
So what’s it all mean? Agencies remain incredibly vulnerable to cyber threats. Those threats sneak onto networks and stay there, on average, 16 days before they’re even detected, according to the report. That’s a lot of time to replicate and cause damage.

It’s time to have an honest conversation about using big data to improve cyber security.

Read the full report here, and let us know: Is your agency using big data to boost cyber security? Has it had a demonstrable impact protecting data and networks? Honestly, we really want to know.

alt
Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

A Party Like It’s 1933?

What’ll it be – Cup of IT, beer, or shirley temple?  MeriTalk’s sister organizations, O’Keeffe & Company and 300Brand, are celebrating 18 years in business.  Our theme, the 18th amendment, prohibition.  Join us to wind the clock back to 1933, when Congress passed the 21st amendment repealing prohibition.

We invite you to help us celebrate our 18th anniversary and the repeal of the 18th amendment at theState Theatre in Falls Church.  The party will feature live Irish music from my good friends at Brendan’s Voyage.  Everybody’s welcome.

18 years serving our community.  What better way to say thank you to our community for your confidence than throw a party where everybody’s invited?  Cheers to 18 years.

 

Ink!?

Thinking about inking?  Quick march to the parlor.  Last week, the Army relaxed its restrictions on tattoos.  Used to be you couldn’t have more than four tats below the knee or elbow – and no body art could be bigger than a soldier’s hand.

Thinking I’m going to get all Andy Rooney about tattoos?  Au contraire.  I say do as you will – it’s your body.

My question, where will we get the extra ink?  I’d like to make a constructive suggestion.  Maybe we should consider the exclamation point.  I don’t know if you’ve noticed it, but people can’t seem to resist spilling them into their emails, texts, greetings cards, and even shopping lists.  Remember to buy peanut butter!  My follow up question – why?  Perhaps people should consider if the phrase or observation is really worthy of an exclamation point?  You see, exclamation points are like expletives and shouting – if you use them all the time, then they lose their impact.  Where’s an exclamation mark really warranted?  The second coming of Christ!  Oh my God!  And, that Steve O’Keeffe’s a real *******!

I’d say the same for awesome.  Consider, does it really inspire awe?  If not, you might try nice – fewer letters.

If we recycled the ink that doesn’t go into exclamation points and awesomes, we’ll surely have plenty in the barrel for tattoos.

1 … 14 15 16 17 18 19