Cubicle farms are dying. Where can I send flowers?

We can work anywhere, but it takes IT smarts to ensure that an increasingly mobile workforce has secure access to whatever it needs, whenever it needs it.

Managing the mobile enterprise is critical, and it’s the focus of next week’s Citrix Mobility 2015 Government Summit, bringing together experts for a deep dive into enterprise mobility management – from mobile device management to secure network access and data security.

Beyond E-Mail
Mobility isn’t just a perk. It’s a prerequisite for getting more work done faster.

In fact, the first goal of the Federal government’s digital strategy is to “enable the American people and an increasingly mobile workforce to access high-quality digital government information and services anywhere, anytime, on any device.”

“Always-on” and “always connected” have become routine. It’s no longer about receiving and sending e-mail from anywhere. It’s also about having access to the documents, data, and applications workers need instantly, without having to return to their desks and without having to jump through hoops.

IT Heavy Hitters on Deck
Howard Schmidt, who served as Special Assistant to the President and the Cybersecurity Coordinator for the United States, will provide the keynote at the Citrix summit. The White House will send the inestimable Lisa Schlosser, who serves as serves as the Deputy Administrator, Office of E-Government and Information Technology, Office of Management and Budget, Executive Office of the President and Deputy Federal Chief Information Officer, to discuss the Federal Information Technology Acquisition Reform Act (FITARA).

Don’t miss the draft guidance on changes to FITARA.

The People Have Spoken
Telework is the original mobility initiative, and it continues to gain favor as it moves from concept to mainstream reality.

In 2014, 29 percent of Federal workers participated in telework programs, up from 26 percent in 2013 and 25 percent in 2012, according to the Office of Personnel Management’s Federal Employee Viewpoint Survey.

Technology is no longer much of a barrier. Among those who don’t telework, 5 percent said that’s because of technical issues, down from 6 percent in 2013 and 6 percent in 2012.

Down on the Farm
At the U.S. Department of Agriculture, our friend and fellow Iowan, Secretary Tom Vilsack, said increased telework has allowed $18 million of cost avoidance in transit subsidies to Agriculture Department employees.

That’s something to moo about. Maybe Secretary Vilsack can find a new use for all those empty cubicle farms popping up at Ag and at other agencies.

How is your agency doing? Does it have a progressive mobility initiative? Let us know. And let us know how your agency can improve mobility for its workforce.

The Citrix Mobility 2015 Government Summit is scheduled for Monday, June 8. Start the week off right by registering here to discover the best mobility strategies, meet interesting people, and hear some great new ideas.

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

Snowden and Manning introduced the world to insider threats. Not only do we know what that means now, we also understand how difficult it is to stay ahead of such threats.

But with the expansion of mobile technologies and increasingly sophisticated threats – both inside and outside – the whole nature of cyber defense is transforming before our eyes. What worked a short while ago can no longer be expected to do the job.

Guarding the Perimeter Won’t Cut It
“Identify and protect” used to be the standard defense, notes Symantec Senior Vice President and Chief Information Officer Sheila Jordan. But that doesn’t represent an effective approach any longer, she told the Symantec Government Symposium recently.

“Identify and protect is where we have historically been, and for a long time that served a great purpose. But now we need to move to…‘detect, recover, and resolve’ as fast as we possibly can,” Jordan said. “I want to detect, recover, and resolve an incident before a person even knows what happened.”

In the same way, cybersecurity is no longer just about guarding the perimeter. In fact, it’s not even clear where the perimeter is any longer.

Crumbling Walls
The rapid growth of mobile devices and the growing phenomena of the Internet of Things are expanding exponentially both data collection and the ability to access it. More data and more access points make security more difficult.

“The four walls of an enterprise have crumbled,” said Jordan. “There are no four walls anymore. So the data is traversing… in and outside the firewalls, with the devices, back into the devices, oh, and I forgot to mention apps and cloud. So I don’t think we have a choice but to figure out how we’re going to have end-to-end security architecture and how that’s going to traverse around the data so that ultimately we’re protecting that data (from) inside and outside threats.”

Introducing Analytics
Government Acquisitions Chief Technology Officer Prem Jadhwani agreed. Jadhwani, who joined Jordan at the Symantec Government Symposium, said analytics can help organizations look at the mountains of data coming in from various sources and correlate the data.

“I see big data as a perfect solution to solve cyber problems,” he said.

But when?

“It’s happening faster than you think,” Jordan said.

That “Oops” Moment
Not every data breach is the work of a malicious insider, of course. Organizations have a harder time protecting data from well-meaning employees who unintentionally expose information or systems to risk. Well-meaning vendors can also slip and disclose data accidentally.

“Insider threats aren’t just your employees,” Michael Dent, Chief Information Security Officer, Fairfax County, Va., said. “They also are your contractors, your vendors, your volunteers, potentially, that come in and work for you. We had a vendor who took data from the county on a USB, very innocently… and he ended up exposing some county data for over two years on an unsecured file share from his company.”

In fact, 22 percent of data breaches last year resulted from employees accidentally making data public, while only 8 percent were the result of insider theft, according to Symantec’s 2015 Internet Security Threat Report.

Jordan calls unintentional data breaches “a huge learning opportunity.”

Where to Start?
The public sector has a long way to go to build mature insider threat programs, Steve Smith, Insider Threat Program Coordinator at the U.S. Department of State.

“We’re nowhere near where we need to be,” said Smith.

Organizations that want to build an insider threat program should focus on what data they want to protect and then put the technology in place to keep it safe, said Jadhwani. That includes encrypting it and using two-factor authentication.

Institutions then need to understand which employees have access to the data that requires protection.

“Look at your privileged users,” said Jadhwani. “See what they are doing. Rather than waste time on who’s trying to come from outside, let’s look at where our crown jewels are, and let’s focus our attention there. I would say it doesn’t stop with technology. I have an acronym for that – BEST. ‘B’ is the background investigation, ‘E’ is employee behavior, ‘S’ is situational awareness, and ‘T’ is training. If you combine all the policy, tools, and technology together… it will work, and it will pay dividends.”

Learn more: Listen to the full discussion on insider threats, read the complete Internet Security Threat Report, or see a list of all session podcasts.

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

Lots of people are talking about cloud computing. So listen carefully.

Even if the term is a misnomer, cloud computing is a big deal. Here’s the thing – organizations can do anything in the cloud that they can do on-premises. So why are Federal agencies still investing just a fraction of their IT budgets on cloud computing?

DevOps Trending Up
A new study by MeriTalk, “The Agile Advantage: Can DevOps Move Cloud to the Fast Lane?” helps connect the dots. Agencies want to move more quickly, and 66 percent say they need to move IT services to the cloud faster to meet mission and constituent needs. But it’s not easy. However, some Feds are beginning to see DevOps as an option.

DevOps is an approach that brings software engineering, quality assurance, and IT operations together as an integrated team to collaboratively manage the full application life cycle.

By the Numbers
Just 22 percent of Feds are very familiar with DevOps today, but 60 percent say they can see DevOps in their agency’s future.

That’s not all – 63 percent say DevOps will speed up application delivery and migration, and 68 percent see DevOps as a viable path to improve collaboration between IT development, security, and operations teams.

Speeding Up with DevOps
DevOps is about speeding up software development.

Conventional development cordons off software developers from IT operations and quality assurance. Each team does their thing serially, one after the other. DevOps speeds everything up. It’s automated and collaborative. Management consultant Accenture believes DevOps can result in a 50 percent increase in speed to market, according to its “DevOps: Services Overview.”

The Secret is Out
So here’s a question – can DevOps help agencies migrate to the cloud faster?

Maybe DevOps and cloud computing go hand in hand. Like peas and carrots, apple pie and ice cream, or B.B. King and blues (RIP, B.B.). According to the new study, Federal agencies are just starting to adopt DevOps, but the majority sees it in their future.

Read the full report about DevOps to learn more about how it can help Federal agencies.

And learn more about Federal cloud.

Is DevOps in your future?

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

Numbers don’t lie. These numbers from Symantec’s Internet Security Threat Report are scary, but they describe what’s at stake in the never-ending fight against hackers. Last year:

• Attackers targeted five out of six large companies, a 40 percent increase over 2013
• 24 zero-day vulnerabilities were discovered
• 317 million pieces of new malware were created

That’s just the tip of the cyber threat iceberg. It all adds up to a big problem.

Making Data Count
So how does law enforcement get ahead of the attackers?

Data and analysis. One of the most important pieces of information for law enforcement in a cyber investigation is the malware, Allison Tsiumis, section chief with the Federal Bureau of Investigation’s Cyber Division, said at the Symantec Government Symposium. Malware can reveal a lot of information, so law enforcement must:

• Maintain a current inventory of known malware
• Track which malware threat groups use to carry out attacks
• Reverse engineer malware once it’s identified and contained to see how it works and what it can do

Law enforcement must also understand the TTPs of cyber criminals – their tactics, techniques, and procedures – including:

• Who the hackers target
• When they launch attacks
• How they carry out attacks
• What method they use
• What data they target

Connecting all these dots can help law enforcement identify hackers and even capture the bad guys. Understanding the questions law enforcement asks in its cyber investigations can help Federal agencies better understand how they should respond following a cyber attack.

Don’t Count Out the Good Guys
Stopping attacks and identifying the criminals isn’t easy, but methodical data collection and analysis has helped.

The FBI gathered enough data to pinpoint which unit of the Chinese People’s Liberation Army (PLA) was responsible for cyber attacks that led to charges being filed against five people in May 2014. The indictment named members of Unit 61398, which was publicly identified in 2013 as the Shanghai-based cyber unit of the PLA.

“That was really key, to be able to drill that far in with our investigation techniques to get that distinct of an identification of the threat actors. Not just the threat group, the Chinese government, but drill down to their actual location,” Tsiumis said.

The Justice Department’s indictment charged the PLA members with hacking into the networks of Westinghouse Electric, the United States Steel Corporation, and other companies. Jeff Brannigan, a special agent with the Department of Homeland Security’s Immigration and Customs Enforcement, said at the Symposium that the theft of intellectual property, like the thefts carried out by the PLA, “is a pervasive crime that is only going to grow in volume and severity.”

Jason Brown, Assistant to the Special Agent in Charge in the U.S. Secret Service’s Criminal Investigative Division, said that agency’s efforts have allowed it to determine that Russians in former Soviet states represent the leading perpetrators of cyber attacks against U.S. financial institutions.

“There are a lot of other nationalities and actors that are involved in computer crime,” Brown said at the Symposium. “The Secret Service views specifically those attacking our financial infrastructure seem to be mostly emanating from Eastern Europe or are Russian-speaking individuals.”

Listen to the full discussion on cyber intelligence, read the complete Internet Security Threat Report, or see a list of all session podcasts.

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

Honesty is the best policy, right?

That’s why honesty has its own day – tomorrow is National Honesty Day. No lie. Funny that it comes at the end of the month that begins with April Fool’s Day. Or maybe that’s ironic…

So let’s be honest. Cyber’s all the rage. So is big data.

While some agencies are using analytics to improve cyber security, many are not, according to a new report from MeriTalk, “Go Big Security.” Or they don’t know how best to use the scads of data they collect to improve cyber security.

Numbers Don’t Lie
All agencies struggle with cyber security. They struggle with protecting data and networks. Remember this line from the White House’s annual FISMA report in February?

“Federal agencies reported nearly 70,000 information security incidents in FY 2014, up 15% from FY 2013.”

Agencies are investing in security technologies, deploying network analysis and visibility solutions, and investing in skills training for personnel. But big data isn’t among the go-to solutions.

While 86 percent of cyber security professionals in Federal, State and Local organizations believe big data analytics would significantly improve their organization’s cyber security, only 28 percent are actually leveraging big data to identify and defend against hackers.

In many cases, agencies have the data but they don’t know what to do with it. According to the report, 68 percent of government cyber professionals say their organization is overwhelmed by the volume of security data.

There’s also a strategic issue at play – 76 percent of cyber security professionals say their security team often is more reactive than proactive.

Tell Me the Truth
So what’s it all mean? Agencies remain incredibly vulnerable to cyber threats. Those threats sneak onto networks and stay there, on average, 16 days before they’re even detected, according to the report. That’s a lot of time to replicate and cause damage.

It’s time to have an honest conversation about using big data to improve cyber security.

Read the full report here, and let us know: Is your agency using big data to boost cyber security? Has it had a demonstrable impact protecting data and networks? Honestly, we really want to know.

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

A picture is worth a thousand words. At least. From now until 2020, the digital universe will nearly double every two years, with video surveillance reaching approximately 3.3 trillion hours globally by the same time, according to MeriTalk’s new Video Vortex study.

That’s a lot of words.

Behind the Lens
Surveillance cameras, mobile devices, and even drones give Feds the ability to capture more video data than ever.

An overwhelming 99 percent of Feds believe video surveillance will play a significant role in the prevention of crime, theft, and terrorism over the next five years. Bad guys aren’t like you and me – they don’t like to smile for the camera. How many good mug shots have you ever seen?

The Video Vortex examines video surveillance across Federal IT, from the challenges to the opportunities for agencies to enhance the value of their video data assets.

Time to Hit Pause?
All that data can pose problems. For instance, 54 percent of video data is never analyzed.

Feds already tap into some real-time capabilities as 57 percent use the data to track suspicious behavior, 49 percent use it to monitor traffic, and 38 percent harness it for anomaly detection. Imagine what they could do if they analyzed all the surveillance video they capture.

Focus on Solutions
What’s the answer?

If agencies want to keep up with the unprecedented influx of video information, they must constantly revamp their IT infrastructure – storage, computing power, and personnel. Right now, 91 percent of IT professionals say they need to increase storage, 89 percent believe they need to increase computing power, and 84 percent believe they need to increase personnel.

Once organizations tackle storage and personnel, they can use advanced analytics to gain more powerful insights for better outcomes.

Picture This
What if agencies worked a little harder to define roles and collaborate? A whopping 79 percent of respondents believe their agency needs to improve collaboration between physical security and IT to improve their surveillance programs.

Feds need to reach a consensus over who is in charge – 76 percent of physical security managers currently see video surveillance as a collaborative endeavor, but only 33 percent of IT managers believe it’s a shared responsibility.

Feds that work together are more prepared for the influx of data (81 percent versus 24 percent), more likely to analyze at least 50 percent of their data (63 percent versus 47 percent), and more than twice as likely to operate an edge-to-core platform architecture for surveillance (92 percent versus 44 percent).

A picture is worth a thousand words, but only if you’re ready to handle the video.

Join our free webinar on June 11 to hear about video surveillance, trends, analytics, challenges, and insight from Feds on collaboration and infrastructure. Register here.

Read the full report here. And let us know – how many surveillance cameras do you see in a typical day?

Andrew Doggett contributed to the report.

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

It may be April Fool’s Day, but cyber’s no joke.

John P. Carlin was confirmed as the Assistant Attorney General for National Security a year ago. He’s a serious gentleman with a serious job. At DOJ’s National Security Division, he heads law enforcement’s cyber security efforts.

Heading Off Disaster
In a speech last year at Carnegie Mellon University, Carlin drew a parallel between terrorist threats and cyber threats. Referring to the work of the 9/11 Commission, he said:

“In its report, the Commission noted that: ‘we are at September 10th levels in terms of cyber preparedness.’ They added that ‘American companies’ most-sensitive patented technologies and intellectual property, U.S. universities’ research and development, and the nation’s defense capabilities and critical infrastructure, are all under cyber attack.’

“I could not agree more.

“As the Commission concluded, ‘One lesson of the 9/11 story is that, as a nation, Americans did not awaken to the gravity of the terrorist threat until it was too late. History may be repeating itself in the cyber realm.’”

Starts with “D”
In other words, let’s not sit back and react.

In the past Carlin also has spoken about the three Ds – “detect, disrupt, and deter.” Those are ideas he likely will cover when he speaks at the Symantec Symposium. He may also discuss legal reforms necessary to support international efforts to prosecute the bad guys.

Cyber Command’s Role
Carlin will be joined at the Symposium by Air Force Lt. Gen. Kevin McLaughlin. He’s the deputy commander of the U.S. Cyber Command, which is positioning itself as the nation’s cybersecurity workhorse. The Air Force is working in tandem with a Defense Department-wide initiative to recruit 6,000 personnel from all the services to be part of 133 cyber teams by 2016, according to the Air Force Times.

That’s a big job. But the lieutenant general is a big deal.

Similar Focus
Like Carlin, Lt. Gen. McLaughlin believes in deterrence. He echoed Carlin’s thoughts in a December interview with Stars and Stripes.

“A lot of what we’re doing today is reacting to what happened, so we spend a lot of our time chasing our tails in the cyber command,” he said.

The command’s goal is to get ahead of such threats, perhaps through the analysis of big data from the network that will reveal anomalies to prevent outside incursions before they happen, Lt. Gen. McLaughlin told reporter Wyatt Olson.

Tangled Web
Suzanne Vautrinot, Major General, U.S. Air Force (ret.), will also attend the Symantec Symposium and talk about how cyber threats have evolved from a minor issue to a major problem. The title of her remarks says it all – “Cybersecurity isn’t About Your E-mail. It’s About Your Life.”

It’s not just about servers. Everything’s connected – 25 billion devices by 2020, according to Gartner – from cars to front doors, and everything inside your house.

Get the big picture on cyber from Carlin, Lt. Gen. McLaughlin, and Vautrinot at the Symantec Symposium. Should be an eye-opener… and a full house.

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

Fans will fill out 70 million brackets this week in an attempt to win an NCAA Men’s Basketball Tournament pool.

Who’s your pick? Kentucky? U Va? Both look strong.

Apparently the odds of picking a perfect March Madness bracket are less than one in 9.2 quintillion (that’s 9,223,372,036,854,775,808), according to Science Daily, which credits DePaul University Mathematics Professor Jeff Bergen with the calculation.

Could you apply Big Data analytics to improve your odds?

Brackets and Big Data
Every statistic is a data point, and lots of fans will rely on those data points this week as they fill out their brackets. Microsoft’s Bing is offering 10 years of data to fans who want to use analytics to fill the intellectual gap.

Like this: teams that travel less than 100 miles win 77 percent of the time, while teams that travel more than 500 miles win 46.5 percent of their games.

That’s a lot higher than your odds of being audited by the Internal Revenue Service. The Internal Revenue Service audited only 0.86 percent of individual taxpayers in 2014, according to the Wall Street Journal’s Laura Sanders. That was the lowest rate in a decade, according to data released by the agency.

Keeping Score
Big Data has Big Implications for the government in many sectors. Cybersecurity and healthcare, for example. It can help agencies hunt down and stop fraud, waste, and abuse. The amount of money the government loses to those three each year is madness…

But do Feds make the most of their data?

A Better Offense
We plan to find out.

MeriTalk has gathered some top IT talent to discuss data management at the Informatica Government Summit on Thursday, April 23, at the Grand Hyatt D.C. They will discuss:

• New opportunities in big data analytics – fueled by the Data Act, metadata, and emerging data governance models
• The impact of data management on reducing agencies’ attack surface as well as Data Loss Prevention – and how that translates into better security and improved uptime
• How data quality, data accessibility, and data security affect data center consolidation, cloud initiatives, mobility, and other IT initiatives

Leading the Fast Break
Joyce Hunter, Acting CIO at the Department of Agriculture, and Dave Dutton, Chief Data Officer at the Energy Department, will sit on MeriTalk’s Big Data panel. They’ll explain how they’re applying data analytics to solve big problems – sharing their insights so you can do the same.

Learn more about the Data Summit and register here. And let us know how your agency uses Big Data. Can you point to tangible results? And good luck with your brackets – I think this is your year.

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

Continuous monitoring is surging along, but agencies are really bad at authentication.

Cyber attacks were up 15 percent last year.

Agencies spent $12.7 billion on cybersecurity in Fiscal 2014. The annual Federal Information Security Management Act compliance report paints a dismal picture of Federal IT security.

Let’s break it down.

Authentication efforts are lagging. “Numerous agencies have made no progress meeting the Strong Authentication CAP [cross agency priority] goal. SBA, NRC, HUD, Labor, and State were all at 0% Strong Authentication implementation at the end of FY 2014.”

Fifteen agencies “have yet to reach even 50% implementation on the Strong Authentication initiative.”

Fiscal 2014 goal was to have Strong Authentication implementation at 75 percent. That’s a big deal because most cyber threats can be neutralized using Strong Authentication, the report says: “US-CERT incident reports indicate that in FY 2013, 65% of Federal civilian cybersecurity incidents were related to or could have been prevented by Strong Authentication implementation. This figure decreased 13% in FY 2014 to 52% of cyber incidents reported to US-CERT.”

What’s Your Password?
Weak authentication systems plague many agencies, and not surprisingly, those with weak systems suffer more attacks.

“Agencies which have the weakest authentication profile allow the majority of unprivileged users to log on with user ID and password alone, which makes unauthorized network access more likely as passwords are much easier to steal through either malicious software or social engineering. The following 16 agencies fall into this category: State, Labor, HUD, OPM, NRC, SBA, NSF, USAID, USDA, Energy, DOT, Interior, VA, Justice, Treasury, and NASA.”

Sixteen? Yikes.

Ticked Off? Nope.
But agencies are doing much better implementing Trusted Internet Connections, or TIC. Today, the report says, 92 percent of agencies have TIC 2.0 capabilities. Well that’s one bright spot.

Feds Like CDM
CDM looks like a strong point, too. “Based on the IGs’ reviews, continuous monitoring programs were in place at 19 departments. Seven IGs reported that their department had all components of a continuous monitoring program in place.”

At the end of Fiscal 2014, 1.7 million licenses for security monitoring tools and products had been purchased by and distributed to agencies.

It’s a good thing: Cyber attacks increased 15 percent last year, and they show no sign of slowing down.

Feds Respond
Feds aren’t standing still.

First, President Obama announced the new Cyber Threat Intelligence Integration Center. CTIIC, or “see-tick,” will reside in the Office of the Director of National Intelligence, gathering and coordinating data from cyber programs in the intelligence world and sharing it with civilian agencies, including the Department of Homeland Security and the FBI.

The idea is to ensure that intelligence agencies don’t hoard their information and that more of it gets to DHS’s National Cybersecurity and Communications Integration Center (NCCIC), reports The Hill’s Cory Bennett. The center will also ensure agencies are exchanging cyber data with one another. Intel officials aren’t the only ones being asked to take on leading roles. The administration also issued a new executive order promoting information sharing on cyber security in the private sector.

DISA’s New Role
The Defense Information Systems Agency (DISA) is taking over day-to-day operations of the U.S. Cyber Command from the National Security Agency (NSA).

The change allows CyberCom to focus on strategic operations and coordination between combatant commands. NSA Director and Commander of the Cyber Command Adm. Mike Rogers told Newsweek CyberCom is behind in terms of building its cyber defenses and creating a framework for when and how to go on the offensive, reports Lauren Walker. “We’re not mature, and we’re clearly not where we need to be,” Rogers said. “I just think, between a combination of technology, legality and policy, we can get to a better place than we are now.”

Reading between the lines: Is this more fallout from Snowden and Wikileaks or just an interesting subplot? Do we have to wait for the sequel?

CIA in on the Act
CIA Director John Brennan is getting his agency into the action, too. The CIA will dramatically expand its cyber-espionage capabilities as part of a restructuring plan, reports the Washington Post’s Greg Miller.

Although smaller than the NSA, the CIA has substantial cyber capabilities. Miller writes: The agency’s “Information Operations Center, which handles assignments such as extracting information from stolen laptops and planting surveillance devices, is now second only to the Counterterrorism Center in size.” He continues: “The CIA also oversees the Open Source Center, an intelligence unit created in 2005 to scour publicly available data, including Twitter feeds, Facebook postings and Web forums where al-Qaeda and other terrorist groups post material.”

Cyber Symposium
The cybersecurity plot thickens at the Symantec Symposium April 15, where cyber experts will be laser-focused on insider threats, mitigating risk, managing information, and information access.

Starring experts from DOD, DHS, NSA, FBI, NCIS, DISA, FCC, CERT, and the State Department, the symposium will deliver unique perspectives and expertise from a range of stars and rising stars.  And don’t miss former FBI Director Robert Mueller’s keynote.

Let us know what agencies can do better to improve cybersecurity and what law enforcement can do to protect consumers from the next Target-like breach.

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

Revelations that Hillary Clinton exclusively used a personal email account to conduct government business as Secretary of State should scare the hell out of CIOs.

The government spends $14 billion a year on cybersecurity, but no amount of spending or regulations will make a difference if top leaders flout the rules and set up a parallel shadow IT system on unprotected public networks.

This is what should be keeping CIOs and other IT leaders up at night. Nearly 54 percent worry about security for cloud installations, but at least with FedRAMP-approved technologies they can rest assured that the security risks have been mitigated. But that should be the least of their worries if employees are going off the reservation.

“What’s the biggest threat to corporate security?” asked Gregory Millman in a Wall Street Journal piece in 2013. “In many companies, it could be the CEO.”

In government, it could be cabinet secretaries, congressmen, agency chiefs, directors, generals, admirals … the list goes on. All have needs to access vast quantities of critical data and staffs eager to make things easier for them. If rules are made to be broken, leaders are the likeliest to break them.

Going Rogue
Of course, once the staff sees the boss going rogue, it’s not long before they’ll do the same. ‘Do as I say, not as I do’ only goes so far.

John Banghart, director of Federal Cybersecurity with the Cybersecurity Directorate of the White House National Security Council, told a MeriTalk gathering of Federal cyber pros last summer: “We [have] often failed… to do a good job with what you might call the cyber hygiene element, configuration management, vulnerability management, asset management.”

Shadow IT networks are among the worst vulnerabilities, because they exist outside the view of IT managers. You can’t catch that with CDM, no matter how much you spend, if everyone in the agency is in on the deception, as may have been the case with Hillary Clinton.

A 2013 MeriTalk study found half of all Federal cyber officials believed their agencies security policies were violated once a week. The Secretary of State and her staff must have been violating them dozens of times a day.

IT companies are investing millions to help ensure Cloud solutions meet maximum security standards, and they should. But all the money they’re investing in FedRAMP is for naught when leaders or rank-and-file employees decide to do their own thing.

“Despite increases in cybersecurity technology investment, a failure to address human factors and engage employees as part of an integrated security strategy leaves today’s businesses and governments critically vulnerable to cyberattack,” Christian Anschuetz wrote last week in a Wall Street Journal blog.

FISMA Be Damned
The White House put out its annual report on Federal Information Security Management Act compliance last week. It noted Federal agencies reported nearly 70,000 information security incidents in fiscal 2014, up 15 percent from FY 2013.

They didn’t know about Clinton. Her staff said they reviewed “tens of thousands” of pages emails and delivered some 55,000 pages of emails to the State Department. Each email amounts to a potential violation.

Don’t think it stops there. Right now hundreds, if not thousands, of government executives and political appointees are wondering what to do about their gmail, Yahoo, Apple and Outlook accounts. Hillary was not unique.

Snowden Moment?
Clinton’s decision to shun State’s internal email may ultimately offer a silver lining: By bringing the issue to light, it is bound to raise awareness about the cybersecurity risks involved – much like Edward Snowden raised awareness about insider threats. And with Clinton likely to make a presidential run, it’s likely to bring the whole issue into the public debate.

Thank you, Madam Secretary.

What do you think? Did Mrs. Clinton make a major error and put data at risk? Or is this just Beltway bluster?

Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.

Fifty Shades of Grey hit movie theaters last weekend, just in time for Valentine’s Day.

Christian Grey and Anastasia Steele have quite an… unconventional romance.

Romantic tension of a different sort is heating up between Feds and cloud computing vendors.

MeriTalk’s new study, “Cloud Without the Commitment,” digs into that relationship. Seems Feds are getting to know the cloud, but they have some trust issues.

How You Doin’?
Cloud is like the stunning woman at the end of the bar. Feds are the geeks at the other end, trying not to stare. Cloud is the answer to all their dreams – cost savings, improved services, cutting-edge technology. But there are risks to all those rewards.

Feds have to break the ice. Fifty-one percent take the first step by looking at their required IT needs and 55 percent start by assessing data vulnerabilities.

“Talk to her!” Before you miss out on the love of your life.

First Date?
Email, Web hosting, and storage are the common pieces Feds have moved to the cloud. In fact, 75 percent of agencies want to get to know the cloud better but are concerned about losing control of their data.

We know agencies are intrigued by cloud, but they are afraid to make it official.

No Strings Attached?
That’s because agencies are afraid the cloud will turn into the old ball and chain – 53 percent say fear of long-term contracts holds them back from getting more involved with cloud.

It’s more than contracts and losing control of data. The portability of data once it’s in the cloud, moving data out of legacy systems, and data security keep agencies from embracing the cloud. Get it?

Open Relationship?
If there’s one thing Feds like about cloud, it’s open source. Feds who are using – or plan to use – open source software report a more positive cloud experience than those who do not.

Just Friends
So Feds like cloud computing, but they aren’t ready for a long-term relationship. How will this story end? Will Feds fall head over heels for cloud? Will the relationship last?  Read the full report here. Don’t worry – it’s G-rated.
Feel like sharing something Noteworthy? Post a comment below or email me at bglanz@300brand.com.

Bill Glanz is the content director for MeriTalk and its Exchange communities. In the past 14 years, he has worked as a business reporter, press secretary, and media relations director in Washington, D.C.