This page is not built out yet. If you are seeing this page, please contact an administrator.

The Weekend Reader-Nov. 25

Industry Insider: What’s Happening in IT

MeriTalk compiles a weekly roundup of contracts and other industry activity. Stay up to date on everything that’s happening in the Federal Information Technology community. MeriTalk.com keeps you informed about the topics that mean the most to you and creates a targeted platform for cooperation, public-private dialogue, highlighting innovation, and sharing informed opinions. This week: News from Symantec, BAE Systems, and more.

Trumps Tech Advisers: No Restraint, No Regulation

President-elect Donald Trump during his transition is relying on two American Enterprise Institute contributors for advice on technology policy, which consists of calls for deregulation of the National Security Agency and an end to net neutrality: Jeffrey Eisenach and Mark Jamison. Eisenach said the government should create a Federal Cybersecurity Service, a civilian agency with the NSA’s cyber defense assets and the powers of the military and law enforcement to react to cybersecurity problems without having to go through the obstacles of gaining permission from other levels of government. In Trump’s YouTube video, which outlines his plans for his first 100 days in office, he said he would allow the military to develop and use offensive cyber capabilities; however, that poses a problem for the protection of private companies that have been the targets of cyberattack.

Connolly Leads Effort to Hold Election Cybersecurity Hearing

Rep. Gerry Connolly, D-Va., spearheaded a letter signed by 15 members of the House Foreign Affairs Committee to request that the committee hold a hearing on the attempts by foreign powers to influence the U.S. presidential election. “It is our hope that a potential hearing would address what interference took place, how it happened, and how we can prevent such actions going forward, in order to preserve the integrity of the U.S. electoral process,” Connolly told MeriTalk. “Electronic security is an important aspect, but not the only potential form of foreign interference in U.S. elections.” “Ranking Member (Eliot) Engel, one of our most cherished institutions, democratic elections free of foreign interference, is in question,” the letter said.

Grants Support Cybersecurity Education

Leaders of the University at Albany, State University of New York’s cybersecurity program are working on internship opportunities with companies in the area for students to gain cybersecurity experience. The program divided $1 million in grant funding evenly among five academic institutions to support cybersecurity education among students. Between 250 and 300 students are enrolled in UAlbany’s cybersecurity program, which includes a master’s track, as well as accounting and digital forensics programs.

Privacy Groups Stand Against Federal Student Information Database

The Department of Education has plans to build a Federal database of student information, which has sparked protest from privacy groups. The Federal unit records system would include information on student performance throughout school and track students into their careers. Supporters said that the database will help inform policy decisions and enable students to make better choices when it comes to higher education and jobs.

The Situation Report: Prepare For a Radical Shakeup in Federal IT

Analysts and pundits have been wringing their hands for the past two weeks trying to predict what the election of Donald Trump means for Federal IT and technology policy. Of course, nobody has a good answer because nobody really knows.

And while it will certainly take some time before IT issues bubble up to the top of the priority list for the new administration, the reality is that there’s no evidence to suggest that Donald Trump will not embark upon a radical retooling of Federal IT, potentially dismantling the failed General Services Administration’s 18F experiment and reversing course on the Obama administration’s baby, the U.S. Digital Service.

In fact, a radical shakeup is actually more likely than is staying the course. A Trump administration will steer the ship of state away from its current course of filling the government ranks with Silicon Valley heroes and instead turn over the government’s most challenging technological problems to private tech firms that can develop better solutions, under budget, and ahead of schedule.

THE SITUATION REPORT SPONSORED BY:

[the_ad id=”24963″]

Trump’s loose grasp of technology issues and policy means he will continue to delegate many of these decisions to team members within his inner circle. Yes, many observers are hoping beyond hope that Federal Chief Information Officer Tony Scott will agree to stay on beyond the inauguration. But as Scott has acknowledged, nobody is asking. The reality is that the future of Federal IT is in the hands of Trump’s transition leaders for technology—Jeffrey Eisenach, an economist, and Mark Jamison, a research professor.

Neither Eisenach nor Jamison has any practical, hands-on technology management experience in government or the private sector. They are products of the Washington, D.C., think-tank scene. So what is their world view when it comes to IT policy and the role of government? One of the most instructive examples is the approach taken by Eisenach and Jamison to the FCC. Eisenach is no friend of the FCC and has supported significantly rolling back the agency’s authorities. But Jamison has gone a step further, actually questioning the need for the FCC’s existence.

Just how radical an idea is this? Well, consider that the FCC is the second largest source of revenue in the U.S. government–bringing in more than $44 billion last year as a result of spectrum auctions. “Who will auction off spectrum to the private sector?” asked a senior FCC source, who spoke to The Situation Report on condition of anonymity. “All that money goes to pay down the national debt by the way, not to FCC (whose budget has been flat for the last seven years at approximately $400 million). A $400 million investment for a $44-plus billion return in one year is something that the Trump administration might appreciate.”

What are the chances that the likes of an 18F, which has lost tens of millions of dollars, competes with the private sector, and has no major IT program successes to point to (other than a few websites and apps), could survive in a Trump administration that is willing to entertain the thought of eliminating a critical agency like the FCC? What are the chances that the Obama administration’s tech baby—the U.S. Digital Service—will survive Trump’s ongoing “evaluation” of the entire Executive Office of the President, which includes the Office of Management and Budget, the Federal CIO’s office, the Office of Science and Technology Policy, and more?

The reality is, these are not (as some have suggested) questions for a Republican administration. These are questions being posed to a Trump administration—a political organism that nobody yet truly understands. Anybody who thinks they know what is going to happen is simply not telling the truth.

“Is net neutrality toast? Probably,” said a senior FCC official. “Will they stop the activities of the FCC re: privacy and ISPs? Perhaps. However, the advisers may want to look closer if they think the Trump administration would want to kill the $44-plus billion/year in spectrum auctions revenue or their mechanism for rolling out broadband infrastructure to middle America. Not to mention E911 and other emergency telecom services for the nation.”

A willingness to eviscerate a Federal technology player as large and as important as the FCC is clear indication that the Federal government’s Silicon Valley experiment is far from safe. Liquidation of these highly questionable endeavors will not happen overnight. Like climate change, the sea levels are rising slowly but steadily all around 18F and USDS. And they don’t have the waders for it.

The Weekend Reader-Nov. 18

Industry Insider: What’s Happening in IT

Extreme Vetting Will Require Smarter Data, DHS Expert Says

President-elect Donald Trump ran his campaign on the commitment to remove illegal Mexican residents and temporarily ban Muslims from entering the country. Extreme vetting policies would logically accompany these stringent immigration goals. “We need to avoid data glut and information overload,” said Donna Roy of DHS.

Snowden Warns Against Putting ‘Faith or Fear’ in Trump

“What we need to start thinking about now is not how we defend against a President-elect Trump, but how we defend the rights of everyone everywhere,” according to Edward Snowden, the National Security Agency contractor responsible for leaking information about the U.S. government’s mass surveillance program in 2013. Snowden said the Internet is a tool that was built to empower people, but too often it is used by authoritarian governments to disempower dissenters. To overcome this problem, Snowden said that technology companies need to ensure every communication system is “protected by default” from end to end across the world.

Its Privacy vs. Innovation in Wild West of Augmented Reality

In the “Wild West” of augmented reality applications, the U.S. government has to balance the concerns of helping to protect consumer privacy and security while also leaving room for companies to freely innovate, according to witnesses at a Senate Energy and Commerce hearing. It doesn’t always feel like there’s a sheriff out there to help out,” said John Hanke of Niantic. On the other side of the spectrum, white hat hackers, whose aim is to discover vulnerabilities in AR software and help companies patch them, worry that they will be prosecuted for their work. “We worry that our reverse engineering or our attempts to figure out what the flaws might be with a device will be met with legal challenges,” said Ryan Calo.

State Department Leads the Flock in Twitter Usage Among Federal Agencies

Agency Twitter use has become an important factor in communication between the Federal community and the public. Agencies that have the best Twitter strategy, such as the State Department, tend to have been present on Twitter for the longest and have picked up the most followers. MeriTalk studied the Twitter accounts of 15 agencies to determine number of followers, number of tweets, and year that the Twitter accounts were created to determine which agencies are the most successful on the social media site.

The Situation Report: Bandwidth Trumps Politics for Defense Intelligence

What do you get when you cross a third-generation Portuguese congressman with a completely logical plan to consolidate the military’s Joint Intelligence Analysis Centers around the world?

If you guessed an investigation by the Pentagon inspector general and serious allegations of plagiarism, you are correct.

Rep. Devin Nunes, R-Calif., the chairman of the House Permanent Select Committee on Intelligence whose family hails from Portugal, is waging war on the Defense Department’s plan to draw down U.S. forces at Lajes Air Base on a small Portuguese island in the Azores and reassign military and contractor personnel to a new, modern facility at the British Royal Air Force Base at Croughton. In addition to saving money, the move is in response to an aging infrastructure at the current JIAC in Molesworth, U.K., and the lack of sufficient IT communications infrastructure in the Azores.

But Nunes this week waged an unusually vehement defense of his family’s homeland (unusual in that he represents the people of California, not the people of Portugal) when he called Director of National Intelligence James Clapper and Deputy Secretary of Defense Robert Work to testify before the committee, and proceeded to prosecute his case based on Wikipedia and tourism anecdotes.

Stay with me.

In March, Work met with Nunes and other lawmakers to provide written justification (as a required by the Defense Authorization Act) for the Pentagon’s decision not to move personnel from Molesworth to Lajes. And while the intent was to lay out the communications bandwidth requirements for the JIAC and show why the Royal Air Base in Croughton was a much better communications hub than Lajes, Pentagon IT officials (from the department’s CIO office and the Defense Information Systems Agency) did the unthinkable.

“Secretary Work, are you aware that significant portions of this document that you passed to three committee chairmen to meet a public law were plagiarized from Wikipedia?” Nunes asked.

Pause here for uncomfortable shifting in one’s seat.

“I’m just alarmed…that we would rely on Wikipedia, a free online encyclopedia that’s famously known for most high school students plagiarizing their homework and that the Department of Defense would even use Wikipedia…to provide any information to Congress to put in any report,” said Nunes.

“I’m surprised that this comes directly from a Wikipedia page,” responded Work. “I was required by the National Defense Authorization Act to make a determination that our movement to Croughton was operationally the right call to make and I made that determination and communicated my intent to do that.”

Because the consolidation of facilities will impact the National Intelligence Program budget, Clapper was forced to weigh in on the matter. During briefings last year with the commander of the JIAC at Molesworth, Clapper said he was informed that civilian contractors working at Molesworth had outright refused to move to Lajes.

“Sounds like we are making decisions based on where people want to live,” Nunes shot back.

“You know these are older people who have children in schools, particularly high school age, and I think that the general reaction to that—to move to an island in the middle of the Atlantic ocean—was not very positive,” Clapper said.

“You have to put this into the context of what this question is about,” Work said.

” ‘What was better, Croughton or Lajes?’ There is no comparison. Croughton is absolutely the best information hub,” he told Nunes.

And that’s when Nunes’ argument went from the ridiculous to the absurd. “Are you aware that the Azore islands are a popular vacation spot for people from the U.S. and Europe and have daily flights?” he asked Clapper.

Clapper paused for a moment, the wheels clearly spinning, wondering if he should allow politics to trump the realities of bandwidth.

“Ahh…no, I’m not.”

Moving Time – Federal Data Center Optimization Takes Center Stage

It’s time for Feds to pack their data center bags and start moving to cloud.

Yet enterprises are not as secure in their decision to move to cloud. The Blue Coat Elastic 2016 Shadow Data Threat Report showed nearly 100 percent of apps analyzed do not provide sufficient security and compliance controls to effectively protect data in the cloud. In addition, organizations are running 20 times more cloud apps than they estimate, leading directly to an increase in Shadow IT.

What can Feds learn from enterprises’ experience? And how are Feds faring in the move to cloud?

The Weekend Reader-Nov. 11

Industry Insider: What’s Happening in IT

Trump Administration Likely to Oust 18F

The incoming Trump administration plans to get rid of 18F, the digital services team located within the General Services Administration that has been criticized recently for its spending practices, according to a senior administration official. “People that have actual IT experience will be put into positions,” said the official, who spoke to MeriTalk on condition of anonymity because of the sensitive nature of the transition discussions. Republican Donald Trump won the presidential election on Nov. 8, raising questions about what lies ahead for Federal IT.

Sensors Text Farmers When Cows Get Sick

Farmers should save their cows’ numbers in their phones because cows can now send farmers a text message when they’re feeling under the weather. The farmer maintains a base station that reads all of the data from each of the cows, adds the real-time data to the outdoor temperature and humidity, and then uploads it to the cloud. The system can also email a veterinarian to make an appointment for the farmer, to ensure the cow’s illness can be prevented quickly.

IoT Called a ‘Wonderful Thing’ for People With Disabilities

The Internet of Things (IoT) is a great tool for those with disabilities, experts say, but government and industry can do more to ensure that IoT devices are accessible by all, through the implementation of universal design. “The Internet of Things offers opportunities to increase independence by reducing the need for personal assistance at home,” said Daniel Castro, vice president at the Information Technology and Innovation Foundation, adding that smart pill bottles, sensors in the home, and advances in assistance robots would enable people with disabilities to live at home or alone while still ensuring quality care. “These technologies have potentially enormous benefits for people with disabilities, but these benefits are by no means guaranteed.“

Council of Agency Web Directors Will Assemble a Month After Election

The General Services Administration will start a council of agency Web and digital directors by Dec. 8, according to a memorandum from Federal Chief Information Officer Tony Scott. The memorandum establishes a governance structure that will help agencies comply with Federal laws and policies regarding digital services and websites. Every agency must develop a plan for governing its digital services and post it on the Federal government’s digital strategy webpage. This way, digital services will be available and an integral part of each government agency.

The Situation Report: FITARA Scorecard Changes and IC ITE Funding Questions

Change Is In The Air

It’s no secret that a lot of Federal chief information officers aren’t fans of the methodology behind the Federal Information Technology Acquisition Reform Act (FITARA) scorecard issued by the House Oversight and Government Reform Committee. Critics have complained that the scoring methodology wasn’t always fair and reasonable.

Well, my remote listening post positioned outside the Rayburn House Office Building has picked up strong signals that changes to the FITARA scorecard are being crafted for the next session of Congress. Chatter indicates that in addition to making the scoring process more reasonable for agencies, lawmakers “want somebody to be accountable” for the progress (or lack thereof) of agencies. “Part of the changes involve adding responsibilities and making OMB responsible for oversight,” according to a source close to the discussions.

“The discussions are really focused on normalizing the scorecard so that there is more consistency across different agencies of different sizes, complexity, and culture,” another source told The Situation Report. The new scorecard will likely refine the metrics used to evaluate how agencies are reporting CIO authorities.

Could IC ITE Suffer Under Trump?

In August, then-presidential candidate Donald Trump openly expressed his distrust of the U.S. intelligence community. But now that he’s the president-elect and receiving classified intelligence briefings, will he come around to the reality that the IC is critical to his ability to make sound national security decisions?

Time will tell. But can the intelligence community’s central modernization effort—IC Information Technology Enterprise (IC ITE)—wait that long? My Capitol Hill sensor network has detected tremors stemming from potential funding shortfalls for the massive effort to deploy a common IC desktop, secure online collaboration tools, and secure common cloud architectures across the 17 major components of the U.S. intelligence community.

Because IC ITE is not a collection activity and is not owned by any one organization, “adequate funding may depend more on voluntary contributions—a coalition of the willing,” according to a recent study intercepted by The Situation Report. “As all resources are finite, money used for IC ITE means less money available for agency-specific priorities.”

More Questions For 18F

Imagine Federal CIO Tony Scott’s surprise when he heard that the U.S. Digital Service and the General Services Administration’s 18F were working on developing a single sign-on capability for the Centers For Medicare & Medicaid Services (CMS). My deep intercept station outside the New Executive Office Building picked up information on a conference call between an OMB emissary and representatives from CMS, USDS, and 18F.

“It would take $100 million. Why do you guys think you can do this?” is all my intercept station picked up before we lost the signal. Intelligence sources indicate 18F has yet to respond to the question.

MeriTalk Names GSA Source

Reacting to a battery of recent MeriTalk articles on GSA 18F and FedRAMP, voices inside and outside GSA have called for MeriTalk to name our source. Well, this time, we’re completely transparent–it’s Matt Goodrich. Just last week, the FedRAMP PMO issued a message to FedRAMP JAB-certified CSPs. The FedRAMP PMO tells CSPs that have invested millions to attain a JAB certification that they need to demonstrate that they have at least six unique agency customers–or they’ll get kicked out of the JAB certification and need to pursue an agency sponsor.

FedRAMP Eats Its Own Children

CSPs are incensed by what they see as the FedRAMP PMO moving the goal posts. And, interestingly, the FedRAMP PMO states that it may change the minimum threshold–so that CSPs may need more than six agency customers to maintain their JAB certification. Peculiar timing for this assertive move from the embattled PMO. GAO just announced that it’s auditing the FedRAMP process–and Congressman Gerry Connolly’s convening government and industry to frame new legislation to corral the wayward “do-once-use-many” cloud cybersecurity certification program. By requiring CSPs to demonstrate their governmentwide installation, the FedRAMP PMO will likely turn its biggest allies into its biggest adversaries. CSPs are incensed by the prospect of their massive investments going up in smoke.

What If CSPs Say No?

What if CSPs refuse to provide the PMO with information on where they’re installed? Few have agreed to provide this information to date. It’s widely known that CSPs don’t want to provide their customer lists for fear of tipping their hands to the competitors. It’ll be interesting to see how GSA goes about enforcing the reporting requirement–not to mention the eviction process. Time to lawyer up?

Quack, Quack

Congressman Will Hurd triumphed in Texas–that’s a huge win for the tech community. That said, it’s unlikely we’ll see any movement on MGT until the new session–why would Republicans not wait to negotiate with themselves? At the same time, we’ll likely see 18Fers jump ship fearing Trump. That could spell a whole new chapter for FedRAMP, cloud, and government procurement reform. Industry and government got together to provide recommendations to fix the program. GSA refused to acknowledge this effort. Mr. Goodrich’s email to CSPs has surely changed the tone and urgency of the debate.

Reporting to You Live – Real-time Updates for Agencies

This just in, a threat has surfaced on an agency network. Can it be stopped in time? Continuous Diagnostics and Mitigation (CDM) combined with Symantec + Blue Coat’s security platform enables real-time threat detection, allowing agencies to mitigate and address any risks.

Agencies need visibility into their networks, control over user access, and protection of their boundaries as part of CDM.

The Weekend Reader-Nov. 4

Industry Insider: What’s Happening in IT

Air Force Speaks to Congress About Cloud Computing Fund

The U.S. Air Force is talking to Congress about starting a multiyear, replenishable fund for cloud computing, according to Frank Konieczny, CTO of the Office of Information Dominance and CIO of the Office of the Secretary at the U.S. Air Force. Cloud computing would be widely adopted by Federal agencies if the congressional funding process changes to accommodate IT modernization. Agencies have trouble predicting the budget they’ll need for cloud computing because of the fluctuating nature of certain applications. “It’s just a ridiculous exercise.” In some agencies, cloud adoption is occurring whether or not it’s cost effective.

New Cybersecurity Job Search Tool Features Interactive Map

The National Institute of Standards and Technology announced the release of CyberSeek, an interactive map that shows cybersecurity job availability by both state and locality. At the time of publication, the map showed nearly 349,000 cybersecurity job openings nationwide and a total employed cybersecurity workforce of more than 778,000. The website also includes a Career Pathway section, which provides job seekers and those looking to get into cybersecurity careers with entry-level positions, salary statistics, and potential career pathways. The tool is also designed to help employers find areas of the country with a high saturation of cybersecurity workers, as the current market has more open positions than workers able to fill them.

Q&A: The Indiana University Professor Who’s Trying to Weed Out Fake News

MeriTalk conducted a Q&A with Filippo Menczer, a professor of Informatics and Computer Science and the director of the Center for Complex Networks and Systems Research at the Indiana University School of Informatics and Computing. In May 2016, he and his team launched the Observatory on Social Media (OSoMe), a big data hub for people to analyze social media trends.

Top 10 Ways to Make FITARA Work

Censeo Consulting Group worked with Cyrrus Analytics and Hettinger Strategy Group to create the report “FITARA at a Crossroads.” MeriTalk summarizes the 10 recommendations. GAO would continue to audit the government’s ability to meet legislative requirements. If GAO could access OMB’s agency data, which is more detailed than the information stored by any other entity, they would be able to make more accurate assessments. The grading criteria need to reflect new fields and provide incentive for future FITARA behaviors.

So You’re Moving to Windows 10–Now What?

How Microsoft’s Latest OS is Your Agency’s Springboard to Innovation

In late 2015, DoD CIO Terry Halvorsen announced that all Federal combatant commands and agencies within the Department of Defense (DoD) would need to migrate to Windows 10 by January 2017 as part of a new Windows Secure Host Baseline. Recently, that mandate was pushed back to January 2018—not because defense agencies want to continue to operate on Windows 8, Windows 7 or–wait for it–Windows XP, but because the sheer magnitude of the migration encompasses more than 4 million machines spread out across the most complex organization in the world.

The department’s decision to move to Windows 10 remains solid. As Microsoft’s most secure operating system (OS) ever deployed, Windows 10 offers significant security features baked right in–including secure boot hardware, TPM support, biometric authentication, conditional access and device health attestation. No one is arguing that Windows 10 shouldn’t be standardized across the DoD and civilian agencies at large. What’s slowing the effort at many agencies, however, is the actual migration process–it’s time-consuming, expensive, and unattainable within a year’s time frame.

It doesn’t have to be.

Server virtualization revolutionized Federal data center operations, and that same technology can be applied to the desktop and its underlying applications to revolutionize OS migration, management, and security. Built on the software-defined data center (SDDC) that integrates compute, networking, and storage into a centrally deployed and managed virtual platform, virtual desktop infrastructure (VDI) is unlike the traditional desktop management model that groups the physical device, OS, and applications into a bundled architecture requiring considerable IT involvement. VDI replicates the physical desktop environment by running applications in the data center and enables multiple user desktops to run as separate virtual machines (VMs) that are then remotely presented to end-user devices

Windows 10 is a platform that integrates beautifully with end-user computing (EUC) technologies such as VDI, EMM, and application virtualization while maintaining traditional PCLM functionality. Not only does VDI preserve the use of mission-critical legacy applications and existing hardware, but it greatly reduces OpEx by centralizing and streamlining desktop and application management. Additional methods of virtualization by way of enterprise mobility management (EMM) and delivery technologies like application publishing lend themselves well to workforce mobility and productivity initiatives in non-DoD computing environments. With EMM, agencies can apply the same virtual management and security philosophies to mobile devices running Windows 10–including laptops, tablets, and smartphones.

Legacy applications running older versions of Windows should also not impede migration efforts. While Windows 10 will likely not have the same number of application compatibility issues as older versions of Windows, there will inevitably be some apps that are not compatible on Windows 10. Placing those apps onto a RDSH platform allows agencies to move these problematic apps into the data center and use a remote display protocol to deliver the problem apps into their newly upgraded Windows 10 desktops where the applications won’t run successfully natively.

Government agencies–DoD in particular–are at a fork in the road when it comes to migrating and managing Windows 10. The good news is that they have multiple options, all of which call for the successful deployment of Windows 10 across devices. Yet the DoD mandate in particular is truly the Federal government’s calling card for IT innovation. Agencies can either choose to refresh the old-fashioned, laborious, and expensive way or use Windows 10 as an opportunity to leverage next-gen EUC solutions such as VDI and EMM to radically improve operations, cybersecurity, and user experience across devices, locations, and missions.

To learn more, visit: http://www.vmware.com/solutions/industry/government.html.

Electing a Cloud Winner: Hybrid Gets the Vote

While the final presidential debate is a wrap, the Federal cloud debate (slightly more quiet) continues. Like the election, cloud has the potential to impact government for many years to come, from ensuring soldiers have the needed intelligence to make good decisions on the battlefield, to NIH having the ability to pool medical research and find new cures for disease.

But let’s consider a few questions: how can Federal agencies be in position to best realize cloud’s potential? How much progress have we really made to date? And how can we accelerate progress?

Most agencies that have deployed cloud have migrated non-mission critical applications – web hosting, email, collaboration, and backup services. It appears those moves are going well, as 85 percent of Federal cloud adopters say their agency will increase cloud spending in 2017, according to a recent MeriTalk, “Destination Cloud” study.

However, overall spending on cloud is still falling far short of target.

As agencies progress with cloud plans, most recognize they can’t focus on a private or public model – they need a blended environment and solutions that bring the combined strength of both public and private cloud. They must balance the dual goals of security and access. And, they have to understand application requirements and define mission success.

Ultimately, agencies want an “Anything-as-a-Service” (XaaS) environment where IT teams can deliver needed resources in an OpEx environment – as quickly as their mission requires. They recognize many applications will never enter a public cloud environment, since private cloud meets most of their critical needs.

With ViON’s hybrid cloud environment, agencies get a unique on-premise private cloud that can be leveraged on a consumption-only basis, tailored to meet stringent data controls, security demands, and enterprise-class infrastructure for the most demanding application environments. Agencies buy what they use, and data stays 100 percent within their control. Then, ViON assists agencies in leveraging this solution to connect to multiple public clouds, as appropriate for workload performance and security needs.

ViON also helps agencies lay the groundwork before deploying a hybrid environment, walking through initial questions including:

What is the end goal?
Are there security or compliance mandates to uphold?
Which applications are “cloud-ready”?
What is the migration strategy?
Is there adequate support across the cloud lifecycle?
And, are we confident our service provider is up for the task?

From here, agencies can determine how to best use cloud to create an XaaS environment:

Create a Statement of Objectives that summarizes what your agency wants cloud deployment to achieve. This streamlines acquisition and provides agencies with a more flexible solutions selection process.
Use either a single-contract award or a multi-year contract with options. This simplifies the task of managing and monitoring performance, and helps keep the contract financially viable.
Weigh best value over best prices. This ensures your agency is receiving the cloud that will best achieve mission success.

Learn more about laying the groundwork for cloud migration and deploying XaaS:

eBook: Build Your Cloud Strategy With Confidence.
Video: Power and Flexibility to Achieve More
More: VION Agile Cloud Platform

I’m voting for hybrid to meet IT modernization goals based on workload, security, and operational requirements. A more efficient, more flexible IT environment will pave the way for improved services at lower costs.

This blog post was originally published here.

The Weekend Reader-Oct. 28

Industry Insider: What’s Happening in IT

IG Questions Business Practices, Major Losses at 18F

The General Services Administration’s digital services organization, known as 18F, has consistently overestimated revenue projections by tens of millions of dollars, allowed IT staff to spend more than half of their time on non-billable projects, and continued to hire employees at the top of the Federal pay scale despite losses that now amount to more than $31 million, a new inspector general report found. The report found that 18F overestimated revenues for each year since its founding in 2014. Despite these revenue discrepancies, 18F continued to hire new staff from Silicon Valley. The report also found that “less than half of staff time was spent working on projects billed to Federal agencies.” The remaining time was spent promoting 18F projects, developing 18F brand, and developing a timekeeping system.

State Department Moves to Modular Data Centers

The Department of State has moved from leased data center facilities to data centers on government property by using a modular approach. Two years ago, the State Department mandated that the agency start to use government-owned property data centers. The agency moved from using an 11,000-square-foot lease facility to an 800-square-foot modular data center.

Speed is Essential to Get to Cloud, IT Modernization

When Tony Summerlin, senior strategic adviser at the Federal Communications Commission helped write the first Federal Risk and Authorization Management Program, he said he envisioned the program as a much quicker and sleeker version of what it is today. Summerlin, who spoke at a panel at ServiceNow’s Now Forum on Oct. 26, said his goal was to draft a plan that would accelerate people to the cloud. Instead, it turned into a 1,500-page bureaucratic exercise that he said “wasn’t the point” of the document. According to Summerlin, speed is one of the biggest challenges to Federal initiatives across the board, not just in the application of FedRAMP.

DOJ Aims to Reduce its Data Centers to 3 by 2019

The Department of Justice plans to have three physical data centers by 2019, according to Mark Busby, program manager of data center transformation for DOJ. Busby said that he and his team are still working to optimize data centers and shared services, as well as manage colocation facilities. Colocation facilities offer space, power, heating, and cooling for agencies seeking to store hardware. “The less I get to put into physical data centers, the better.“

GSA, the IG, and Third Time’s a Charm?

So, you heard it here first–GSA does indeed have its underpants full of alligators. This week’s IG report on GSA’s 18F $31 million flutter makes the $800,000 Las Vegas boondoggle look like a pocket-change indiscretion. And, we understand the IG’s not finished yet–not one, but two more IG reports on the way in November and December. After the election, good time to take out the trash–also provides time for any criminal action.

But the waves outside the building at 18th and F Streets pale beside the tempest inside the four walls. The PR spin machine’s bailing hard–look at the posts back on the blog–but the boat’s taking on water fast. And, as folks duck for cover, there’s more dysfunction afloat. 18Fers trampling one another in a scramble to find billable work. At the same time, 18F, FedRAMP, and the OCIO all feuding over long overdue ATOs. Rob Cook will need all his experience working with Monsters, Inc.

MeriTalk got up close and personal with GSA’s dysfunction when working with 18F/TTS and FedRAMP on a Sept. 13 program. Denise Roth approached MeriTalk about using the platform as a jumping off point for broader collaboration to fix significant structural challenges with her two most troubled children. Despite Roth imploring her 18F and FedRAMP leadership to cooperate and answer simple questions, the event was an embarrassing disaster for all involved–here are GSA’s “responses” to the questions we posed on 18F/TTS and FedRAMP. 100-plus attendees were treated to yours truly upbraiding GSA’s 18F/TTS and FedRAMP leadership–here’s that speech. Congressman Gerry Connolly took the lectern next–and told GSA to get its act together or face new legislative action.

Will GSA’s keel-less course capsize the $3.1 billion IT modernization fund? How can the Hill trust GSA to manage the money? What new revelations will come in the next two IG reports?

Vegas or no Vegas, I’d wager there’s change ahead for GSA. Congratulations to those stalwarts in the agency that had the sense to engage the IG–pity leadership didn’t heed your counsel.

The Situation Report: Hello Experienced, Meet Edgy

After 20 years as a working technology journalist in Washington, D.C., I finally made it to the ACT-IAC Executive Leadership Conference this week. So, what did I think?

Well, I was amazed at how many of the same faces from my early days covering government technology still haunt the grounds of Colonial Williamsburg every year, only now those faces are capped by mostly gray and white hair. And while that doesn’t necessarily bode well for the pace of change in government, the sea of gray and white set the stage for one of the most relevant sessions of the two-day event: the airing of grievances between the “experienced” and the “edgy” (aka, the baby boomers and the millennials).

It’s no secret that the Federal government is scrambling to figure out how to attract and retain millennials to help chart the future course of digital government. It’s also no secret that millennials bring some unconventional (ahem, unrealistic?) expectations to the table when it comes to a career in government. And that’s what stuck out like a sore thumb during this session.

Emily Hsu, a strategic programs manager at Agile Defense and one of the panel’s millennial representatives, literally almost caused a mass cardiac arrest when she began explaining how millennials want to work from home in their pajamas. “So what if I work in my pink slippers,” she said. “Would you really think differently of me?”

The scene in the room at that moment was priceless. It looked like a Sanford and Son convention with everybody holding their chest and muttering at the same time, “This is the big one, Elizabeth! I’m comin’ to join ya, honey!” It was a close call for this year’s government chair, FCC Chief Information Officer David Bray. There’s no way the Williamsburg Lodge had 600 defibrillators available to handle that kind of emergency.

But Bray’s insistence that 25 percent of this year’s presenters be millennials served its purpose. It showed the old guard where their leadership and mentoring had fallen short and the precise nature of the culture change the government is heading toward. When she wasn’t asking to work in her pajamas, Hsu was lamenting how everything in the military is based on “hierarchy,” and pushing for a safety net to catch her when her big ideas fail.

What was missing from the discussion, however, was how it’s sometimes beneficial for developing leaders to fall squarely on their face. Good managers build safety nets for their people and try to protect them from every perceived stumbling block. But good leaders teach you to navigate the stumbling blocks and pick you up when you fall.

The truth is, we’re all edgy on the way to experienced. And government needs a healthy mix of both qualities to succeed.

The Weekend Reader–Oct. 21

Industry Insider: What’s Happening in IT

NSA Contractor Will Be Charged Under Espionage Act

The U.S. government is charging Harold T. Martin III under the Espionage Act after concluding that the National Security Agency contractor took home 50 terabytes of classified data, which was first reported by the Washington Post. Martin also had the cyber weapons that the hacker group the Shadow Brokers were attempting to sell online, although prosecutors can’t find the link between Martin and the group. It doesn’t appear that Martin’s computer was breached. Martin also took six banker’s boxes full of documents, which he stored openly in his home and shed.

State Laws Govern Student Data Privacy

Educational technology has demonstrated numerous benefits for both educators and students; however, recent advancements are not without concerns. As ed tech becomes more prevalent in the classroom, privacy rights activists and the Federal government are growing concerned about how sensitive student data is being handled and secured. The Center for Democracy & Technology, along with the law firm BakerHostetler, developed a state-by-state compendium of privacy laws relating to the collection, use, and sharing of student data.

International Law Applies Pretty Well to Cyber War, Experts Find

Current international laws surrounding warfare can be applicable to instances of cyber war, according to experts. However, concerns of attribution and automation can complicate the degree of response a nation is legally allowed to take. Michael Schmitt, chairman of the Stockton Center for the Study of International Law at the United States Naval War College and professor of public international law at the University of Exeter, focused on what a nation-state could legally do in the event of a cyberattack by another country or non-state actor.

Northwestern University Makes Dorms Smart

By 2018, students at Northwestern University will not carry metal room keys. The university is in the process of updating student identification cards to grant access to dorm rooms. The majority of students at Northwestern swipe their identification cards, or Wildcards, to access the library, the dining hall, the recreation center, and their dorm buildings; they use conventional keys to get into their dorm rooms.

Securing Federal Networks in a Post-OPM Breach World

After the OPM breach in 2015, what has the government learned? What would be done differently with today’s technology?

During a Federal News Radio interview, Aubrey Merchant-Dest, Federal CTO, Blue Coat, pointed to guidance from the National Institute of Standards and Technology (NIST) and the Department of Homeland Security (DHS) as ways for agencies to prevent another breach

Mobile Security Depends on Software, Hardware, and Sense

You may have heard the phrase “this is a marathon, not a sprint” used when discussing important programs launched by organizations. That might be the case with some business initiatives, but it doesn’t necessarily apply to Federal IT.

Last year, when U.S. CIO Tony Scott called upon Federal agencies to take steps to protect information and improve network resiliency, he named the initiative the 30-day Cybersecurity Sprint. The directive implied that government IT, as currently constituted, was too beholden to outdated legacy systems and ineffectual security policies, and was woefully unprepared to manage today’s increasingly complex networks.

Mobility is a driving factor behind these challenges. The mobile Federal workforce is using thousands of devices with different operating systems to access Federal networks through multiple end points. Data is being retrieved and shared via the cloud, and is at risk both while in flight and at rest.

There seems to be little that you, as a Federal IT professional, can do to stop this rising tide. You, who are used to maintaining control over every system and application operating over your network, have had to adjust to a new reality.

But there is something you can do.

Software and Hardware’s First Line of Defense

First, take heart that there are a number of new software and hardware features that help mitigate persistent threats derived from mobile devices such as laptops and tablets. Today we have operating systems and processors that work together to deliver tamper-resistant, lock-down security that can help prevent suspicious activity and compromised data.

New operating system (OS) features include virtualization-based security capabilities that make it possible to isolate critical data from the OS and restrict access to certain areas of the software. This isolation can prevent someone from being able to remotely gain control of a specific device.

On the hardware side, processors have also gotten some upgrades; software guard extensions can now be used by applications to set aside private regions of data and code. Here, legitimate software can be housed inside of an enclave and protected from attacks.

Together, these solutions form a solid first line of defense for these end-point devices–but even this is not enough to adequately protect against threats caused by mobile proliferation. Software and hardware security must be accompanied by policies regarding the segmentation of data and users, and the application of basic, common-sense security principles.

Segmenting data and users

Strong, two-factor authentication policies are a must in today’s mobile and cloud-based environment. These policies should be based on the identification of high-value assets that are classified as high, medium, or low impact. For example, data granted a “high” classification would receive the utmost level of security, and so forth.

Segmenting users into role-based profiles is also an effective tactic. This can make it easier to identify and choose devices for each individual, and allow for greater control over that individual’s access privileges. This approach gives you back a measure of control over your workforce’s mobility, while still allowing workers to use mobile devices to their benefit.

Common-sense Scurity Principles

The alternative is to simply let users bring in the mobile devices of their choice, but that can set you up for some serious risks. While it’s becoming increasingly acceptable to allow users to bring these devices into their agencies, you should still make sure that:

All devices are patched and include up-to-date software.
The only data that can be accessed through the device is the data the user absolutely needs (and only agency-approved applications should be allowed).
The device uses a modern operating system, such as iOS, Android, or Windows 10.

This is a pretty straightforward checklist, but it can make the difference between a device that’s safe and one that can introduce unwanted risks to your network. Thankfully, many of today’s laptop and tablet devices include authentication built into the hardware and operating system, which can help make developing and managing rules-based access much easier for you.

It’s somewhat ironic that even though mobile usage has changed the way you handle many of your agency’s IT processes, managing security still comes down to a traditional combination of technology and policies. Today’s operating systems offer a powerful and unprecedented level of protection against mobile threats. When this technology meets sound, baked-in security policies, it creates an exceptional security posture that’s worth running toward.

Calling All #ChangeAgents

The world, our nation, and our public service are all experiencing exponential changes with technology. What we do is increasingly interconnected.

In the midst of change, individuals can choose to maintain the status quo or become #ChangeAgents, leaders who “illuminate the way” and manage the friction of going beyond the status quo. The public mandate is clear: deliver results differently and better. Now more than ever, public service needs #ChangeAgents.

With the upcoming presidential transition, now is the time to develop new proposals to transform how the totality of public service–industry, government professionals, and concerned members of the public–works together. One of our objectives is to deliver nonpartisan, positive #ChangeAgent proposals for the next administration to consider.

The 2016 Executive Leadership Conference (ELC) will gather #ChangeAgents for training and education and showcase examples of #ChangeAgents who are already making a difference today. We need to provide “safe spaces” to experiment on doing public service differently and better.

As an attendee, you will be part of the pivotal movement for public service #ChangeAgents. You’ll have the unique opportunity to:

Participate in executive-level collaboration, focus, and training to identify solutions within transformational leadership, agile government, and disruptive technology.
Discover the transformational changes undertaken in Denmark and find out how they’re exceeding citizen expectations.
Judge the “Voices of Change”–“TED”-like talks on what’s already working in public service and can be scaled. The winning presentation will be presented to the next administration.
Hear the “Perfect Pitches”–“Shark Tank” presentations on ideas for OMB to deliver results differently in 2017.
Get dual perspectives in “Experienced vs. Edgy Debates”–experienced executives and new, rising leaders engaged in provocative discussion on conference sessions, ideas and comments from speakers.

For more than 20 years, ELC continues to be the premier government IT event connecting senior government and industry executives with innovative opportunities to engage, learn, and collaborate.

I’d like to thank my ELC co-chair, Teresa Bozzelli, senior vice president, Sapient Government Services, for her passion and dedication to making ELC 2016 a must-attend event in our industry.

For those who have already registered, I look forward to seeing you in Williamsburg, Va., Oct 23-25. If you have not registered yet, there is still time to do so at www.actiac.org/ELC

The Weekend Reader–Oct. 14

Industry Insider: What’s Happening in IT

White House Announces $300 Million in Tech Funding Ahead of Frontiers Conference

The White House announced that it will provide more than $300 million to support science and technology on the day of the White House Frontiers Conference in Pittsburgh. John Holdren, director of the White House Office of Science and Technology Policy, said these projects prove President Obama’s seriousness about innovation and technology policy; $70 million from the National Institutes of Health will be given to researchers to understand Alzheimer’s and Parkinson’s diseases, depression, and traumatic brain injuries. And $16 million and four partners will be added to the Precision Medicine Initiative to expand its national research study, which seeks to improve medical care.

How David Bray Is Bringing Change to the Executive Leadership Conference

Federal Communications Commission CIO David Bray, who’s been an outspoken proponent of creating so-called #ChangeAgents at every level of an agency’s organizational structure, is bringing his unique brand of thinking to this year’s Executive Leadership Conference (ELC), an annual event hosted by the American Council for Technology-Industry Advisory Council (ACT-IAC) that brings 800 government and industry executives together for two and a half days of leadership development and collaboration. In an extensive interview following the IT Boardwalk session, Bray outlined his plans for shaking things up at ELC.

Robots Will Be Ready to Support Human Life in Space by 2030s

In order to settle on Mars, robots and humans have to work hand in hand, which will be possible soon, according to Red Whittaker, professor at the Robotics Institute at Carnegie Mellon University. “The robotics that support human life on Mars will be an entirely new class of robots,” Whittaker said. “There’s a clear sense of what’s called for and we’re going to come through.” The robots that are on Mars for exploration purposes will have to be updated in order to perceive, plan, and process to solve problems in space. “They have to be compatible with humans,” Whittaker said.

Touhill Expects Full Tour of Duty as Federal CISO

Gregory Touhill is optimistic about his ability to remain in his position through the presidential transition and has many plans that he hopes to carry through that transition. “I expect to be here through the transition,” Touhill said. “I want to have a cyber desktop exercise,” Touhill said, explaining that if senior leaders can spend even an hour understanding what to do in the event of a cyberattack, it can improve overall agency capability.

The Situation Report: One Transition Is Not Like the Other

My remote listening post in Tysons Corner, Va., has picked up increasing concerns about the upcoming presidential transition and its potential impact on Federal IT.

One veteran Federal analyst tells The Situation Report that the “average” presidential transition ushers in 5,000 new appointments, 1,000 of which require Senate confirmation. But the upcoming transition promises to be a unique experience, regardless of who gets elected.

Sources say although a Clinton administration would be viewed as a third term for President Barack Obama, Clinton has staked out some independent turf when it comes to IT policy. In fact, analysts tell The Situation Report that the future of the U.S. Digital Service and the General Services Administration’s 18F digital consulting arm remain up in the air. Both remain “top candidates for change,” according to Tysons Corner intercepts.

“If it’s not in statute, it’s likely to see some changes and, even if it is in statute, how it’s implemented will change,” according to one analyst intercept.

All bets are off, however, if Donald Trump wins the White House, analysts say. Even the most experienced hands in Federal IT policy are hard-pressed to offer predictions of what a Trump administration would mean for Federal IT policy, contracting, and spending.

Transition teams for both candidates are hard at work at GSA identifying issues to focus on and potential key appointees. And while policies can sometimes carry over from one administration to the next, the policies governing how those ideas are put into practice “can change dramatically,” say analysts.

Modernizing Security Clearance Systems

According to the latest Quarterly Progress Update on Insider Threat and Security Clearance Reform, the National Background Investigations Bureau (NBIB) Transition Team, created this month to help stand up the new agency, has partnered with the Defense Department to enhance the security of existing Office of Personnel Management IT systems.

To date, “DoD has identified IT and security requirements for a new and modern ‘eApplication’ system, which will replace OPM’s current application system (electronic Questionnaire for Investigations Processing (eQIP)).”

But the government has a long way to go before significant changes to the security clearance process and insider threat program begin to take effect.

Should CIOs and CISOs Be Talking Security or Resiliency?

Many individuals are running to grab a seat on the cybersecurity train. A clear sign is the sheer number of new companies and vendors at last year’s RSA conference. Most are trying to secure a portion of the network to prevent the latest flavor of cyber threats—crimeware, Web app attacks, DDoS, etc. While their intentions are good, these individuals overlook a crucial part of enterprise security, the business.

Often we’re so focused on locking down data access that we lose sight of whether our business can continue when data is lost, stolen, or compromised.

Instead of asking if your network is secure, step back and ask yourself, “Is my network resilient?”

The Federal government can learn a lot from the commercial sector when it comes to cyber resiliency. Take, for instance, the banking industry. Think about it. If someone denies you the ability to use your money or even steals it, you generally can still get it at the end of the day.

Banks have accomplished this through a level of coordination that extends beyond cyber and information systems to include a series of business processes that allows them to fight through the adversity caused by a cyber incident. They’ve become resilient.

CIOs and CISOs can start to filter through what they need to focus on by asking themselves, “If I were to be attacked today, are we resilient enough to still do business?”

By adopting resilient business and technology practices, business activities will continue regardless of the circumstances. This will reduce the risk of incidents, and it will give you the ability to translate information technology issues into a language that resonates with policymakers and higher-level stakeholders.

Here are some questions to start thinking about when moving toward a resiliency mind-set.

What services deliver the most value to your business and what quality of service is needed for your customers to be satisfied?

How aligned are you to the goals of business owners, and do your security priorities match theirs?

Are you spending more time on threat prevention than threat remediation?

How much do everyday employees know about the latest cyber threats and the impact they can have on their organization?

Resilience should be not only considered, but implemented, exercised, and debriefed to further strengthen given business models.

And remember, there’s nothing wrong with the cybersecurity train, just so long as you know your final destination before you jump on.

For more on cyber resiliency, take a look at “Six Principles of Resilience to Manage Digital Security,” by Gartner contributor Heather Pemberton Levy.

You can also visit our website for free white papers, case studies and blogs on the topics of security compliance, risk mitigation, threat remediation, technology architectures, and much more.

The Weekend Reader–Oct. 7

Industry Insider: What’s Happening in IT

The Situation Report: Contractors and Clearances in the Post-Snowden Era

The FBI in August arrested NSA worker Harold Thomas Martin III, who, like Edward Snowden, was an employee of Federal contractor Booz Allen Hamilton. Former senior officials who’ve worked at both Booz Allen and in the intelligence community as government employees are now questioning the efficacy of the security clearance process and the hiring practices of the firm that provides one of the largest pools of cleared Federal contractors. A former senior career intelligence official, who spoke to MeriTalk on condition of anonymity, said this latest incident doesn’t reflect poorly on Booz Allen but rather highlights the urgency to once and for all reform and modernize the security clearance process.

Headhunters are Stalking Your Cybersecurity Experts

Nearly half of cybersecurity professionals are solicited to consider a job at a different company at least once a week, making for unstable jobs and an artificially inflated job market, according to a recent survey. “People go job shopping all the time or are being asked to job shop.” This has a negative effect on organizations, as an already limited number of cybersecurity professionals end up getting moved too much to maintain constant practices. This bodes well for Federal cybersecurity positions, as government leaders have said that those who choose to work for government often have patriotic motivations.

U.S. Can’t Touch Microsoft’s Overseas Data Centers

Microsoft is building data centers in Germany that are tailored toward customers who want the most stringent privacy protections. Access to information in these data centers will not be allowed to anyone, including Microsoft, without the permission of the customer or data trustee. The German data regulations ensure that customers would be able to see where and how their data is processed.

Patent Office Makes Big Data Open to the Public

Since the official launch of the U.S. Patent and Trademark Office’s Open Data and Mobility program at the end of April, the data platform has accumulated 25,000 unique users and 375,000 page hits. The Open Data and Mobility program makes the agency’s data available to the public, allowing people to view information on patents and research history.

Clouds Mature for Business: Current Trends in Cloud Adoption

As Cloud Computing matures as an engine of cost savings, improved agility, and enhanced security, options have grown beyond the “one-size-fits-all” offerings available to early users. Organizations can choose between a mix of on-premises or off-premises clouds, or implementing hybrid architectures that combine the best features of all these choices into a tailored solution that meets their own unique needs. When choosing cloud services, consider these factors:

Hyperconvergence is Collapsing Infrastructure, Labor, and Cost in the Data Center

The last several years have seen dramatic advances in “hyperconvergence”–the prepackaged consolidation of compute, memory, storage, networking, and virtualization within scalable building blocks. Hyperconvergence is collapsing the equipment stack and gutting the labor needed to integrate, configure, and operate the complex infrastructure of a world-class data center. In addition to savings in cost and labor, hyperconvergence make it possible to dramatically accelerate infrastructure standup and modernization, speeding delivery of savings and efficiencies to tenant end-users.

Data Center Modernization and On-Premises Clouds

Many customers are using this as an opportunity to modernize IT operations and offer internal cloud services to users, building new capabilities within facilities they already own and control. These on-premises, private clouds are an excellent way to bring innovation to users while still retaining full control of infrastructure and operations. Hyperconvergence’s simplicity and cost savings make the on-premises cloud even more achievable and cost effective than ever before.

On-Premises or Off-Premises: Tradeoffs in Control, Cost, and Business Agility

For customers with legacy IT infrastructures and compelling security requirements, on-premise private clouds are becoming the preferred approach to leverage the benefits of cloud. While this “do-it-yourself” approach allows customers to retain complete control over all aspects of their IT infrastructure, cloud service providers (CSPs) such as Microsoft, GDIT, and others offer commercial alternatives.

Security in the Cloud: Are my Data, Applications and Users Safe?

The cost savings obtained by moving workloads off-premises to a commercial CSP can be significant, and CSPs offer additional advantages in scalability, geographic distribution, and pace of innovation that can be difficult for on-premise solutions to match. Leveraging these advantages requires organizations give up a level of control over their infrastructure; the key in making that tradeoff is ensuring the data, applications, and users are safe in the off-premises CSP’s environment.

For U.S. government applications, the Federal and DoD standards that CSPs must meet to certify the security of their clouds are strong and getting stronger. While the security certifications held by CSPs are already sufficient for protecting most commercial and government workloads and data, several vendors are expecting FedRAMP Impact Level 5 approval before the end of 2017. This means that organizations can rely upon the security of CSPs for protecting their data, applications, and users for everything except classified information.

Best of Both Worlds: Secure Hybrid Clouds

As the security and features offered by CSPs continue to grow, organizations should look to realize savings by migrating workloads to commercial infrastructures while still maintaining on-premises clouds for more sensitive (or classified) workloads. As a result, organizations are finding themselves with a requirement for managing a hybrid cloud environment comprised of both sensitive on-premises workloads and less sensitive off-premises workloads. Hybrid cloud solutions provide the best of both worlds: maximizing cost savings by leveraging CSP services, while still protecting highly sensitive information by retaining control over their most sensitive workloads and data within on-premises clouds. As CSPs continue to improve the security of their offerings and IT organizations gain additional experience–and trust–in their hosting, migrations of workloads to CSPs will accelerate.

Beyond Infrastructure: Application Rationalization, Migration, and Modernization

GDIT is helping organizations achieve additional savings by using the migration to the cloud as an opportunity to rationalize their applications architectures and remove redundancy in equipment, licenses, and duplicative services. GDIT has found that modernizing legacy applications to take advantage of native cloud services–such as containers, “serverless-compute” and shared micro-services–can deliver new capabilities while significantly reducing the amount of code that must be maintained. The end result is better business value for users and cost savings for the IT organization.

On-premise, off-premise, or hybrid–cloud infrastructure modernization is delivering transformational benefits to IT organizations today. The future of IT looks bright with a 100 percent chance of clouds!

The Situation Report: Contractors and Clearances in the Post-Snowden Era

When news broke this week that the FBI in August had arrested another NSA employee for allegedly stealing and hoarding highly classified information in his home and car, many immediately raised questions about the efficacy of the security reforms put in place at the agency in the aftermath of the leaks by Edward Snowden.

Such questions are absolutely valid and logical. In the aftermath of the Snowden incident—arguably the most damaging intelligence leak in U.S. history—why was Harold Thomas Martin III able to walk out of what is believed to be one of the most secure buildings in the world with top secret documents and digital information over the course of a decade?

But there are more fundamental questions at stake in this case. Like Snowden, Martin was an employee of Federal contractor Booz Allen Hamilton. Former senior officials who’ve worked at both Booz Allen and in the intelligence community as government employees are now questioning the efficacy of the security clearance process and the hiring practices of the firm that provides one of the largest pools of cleared Federal contractors.

A former senior career intelligence official, who spoke to MeriTalk on condition of anonymity, said this latest incident doesn’t reflect poorly on Booz Allen but rather highlights the urgency to once and for all reform and modernize the security clearance process.

“We have silos that have to be changed and we have to do it now,” said the former official, who’s worked for decades throughout the intelligence community. “The OPM backlog on investigations and periodic re-investigations is also a huge problem, as is the need for better identity management and user authentication.”

The former official, who knows many of the senior leaders at Booz Allen personally, defended the company. “Booz is the largest intel community firm I know. I don’t think there will be any repercussions from this. They’re as good as anybody,” the official said. “What is certainly needed now is moving the continuous evaluation program out of pilot phases more rapidly. We’re going to be moving into a rapid period of modernization and we should use this incident as an opportunity to move faster.”

The Obama administration last month tapped former Northrop Grumman chief of security Charles Phalen to lead the newly established National Background Investigations Bureau. But Phalen and the new NBIB have inherited a massive backlog of investigations and will have to find a way to deal with what one former official described as the out-of-control growth of the contractor workforce.

“When I worked at Booz Allen they were considered the best, at the top of their game,” the official said. “I mean, I wanted to get my Booz Allen shirt to wear so everybody knew I was with the best. Then I moved into government and in 2011, shortly after the company announced their initial public offering (IPO), they underwent this massive expansion. If you had a college degree, they were hiring you. And I immediately began to see a significant decrease in the quality of the employees that they were detailing to my office,” the former official said. “The profit motive was very strong.”

According to the company’s latest SEC filings, it employs 22,600 people, of which more than 15,000 hold a government security clearance.

But one official pointed to a challenge faced by the entire intelligence community: a major generational disconnect between the secrecy requirements of intelligence operations and the millennials entering the workforce. More than 65 percent of the intelligence community workforce date their entrance into the profession to during or immediately following the terrorist attacks Sept. 11, 2001. And many have brought with them fundamentally different views of secrecy.

“Many millennials view access to government secrets as a right, when in fact as a member of the intelligence community it is a privilege,” said a former Department of Homeland Security official. “The old Cold War warriors are all but gone now. But with companies like Booz Allen, where are they hiring from? They’re hiring kids right out of college, who sometimes bring with them the most liberal ideologies and ideas of government secrecy that are so rampant today on college campuses.”

According to the most recent statistics from the Director of National Intelligence, more than 2.8 million people hold a government security clearance. Of those, more than 860,000 are private contractors.

What’s the Big Idea: How Thinking Differently is the Key to True Transformation

The Federal government is not traditionally known as being on the bleeding, or even leading, edge of technology. Yet agencies are being challenged every day to innovate, modernize, and “think outside the box”–many times with limited resources. And these challenges are coming from everywhere: from inside the agency, from outside forces such as hackers, and even from constituents who are engaging with agencies in a digitally transformed world. Anyone can tell you it costs a lot of taxpayer money to dream big.

Or does it?

In reality, the big ideas are already tested and validated in the commercial sector. Sometimes, you can match up the big idea with a transformative approach to realize dramatic change…and equally dramatic savings. Most agencies tend to think of IT modernization in strictly hardware and software terms. But modernization is a different strategy…a different way of thinking that includes human beings as well as machines.

All you need to start with is a mission to transform your thinking.

The Mission

To think differently you need to collaborate in entirely new ways. We’ve done this at Dell EMC and we see it all the time within our customer community. The successful groups, the ones that really transform, start by gathering a small but diverse group of people to help. If you’re not the CIO, then invite the CIO. Now add long-tenured IT staff Federal employees, front office administration, a person from finance, one from human resources, a field officer, and then sprinkle in a millennial or two for good measure. You can’t have fresh ideas by using the same thinking and strategies that you use today.

Start with the core mission of your agency, and identify the tech-enabled tools that are helping you accomplish that mission every day. How well are those tools working? How smoothly is the system functioning? Separate them into three lists – good, average, fail – and then triage the “failing” group by assigning priorities based on a function’s criticality to accomplishing the agency’s mission. How much time, money, or resources will it take to correct each problem you’ve identified? Your workgroup will have different ideas about which challenges are merely challenges, and which are outright roadblocks. Allow them to determine your IT priorities.

Traditional, IT-centric projects focused on by managers operating in silos within an agency, simply do not align with an agency’s mission. An antiquated system of servers, storage, and networking cannot deliver information quickly enough or across enough devices. IT priorities have evolved to both create the new information delivery system and make old systems deliver information to that new infrastructure.

We say a future-ready Federal agency is one whose IT infrastructure is the engine of efficiency, not the anchor that prevents it from moving forward. One whose IT infrastructure not only allows change, but is prepared for it. One that enables IT to unlock greater value from its investments, adopt emerging technologies more rapidly, and focus more on new areas of innovation. Digital transformation is an imperative. It is the difference between a successful mission and utter failure.

The transformation has already begun in the workforce and among your constituents. People are witnessing the myriad ways technology is changing the way they conduct daily life, and they expect to have access to those tools when they get to the office. Providing the latest app-enabled tools creates a workforce that grows more connected even as more employees work remotely.

Next Steps

By simplifying and automating an existing IT infrastructure and updating when and where it’s possible, your agency will discover it can actually free up funds for innovation–even with a flat budget. Dell EMC has worked with numerous Federal agencies, here and abroad, to achieve both savings and modernization.

It takes a strong team to break with tradition, think differently, and apply new strategies to doing business. Change doesn’t just happen organically, and it won’t happen if we continue to rely on old modes of thinking. But if there’s a willingness–to spend differently on different priorities driven by a different strategy–then there’s a clear way to IT transformation that aligns with your agency’s mission, not just IT’s mission.

Is GSA Breaking the Law?

Word on the street is that two new IG reports on GSA 18F/TTS will see the light of day in October. We understand that the reports were supposed to hit the street this summer–but that the IG keeps finding new issues and interviewing more folks at GSA and across the government.

So, do the delays mean there’s more than smoke? Is it true that the Department of Justice is engaged and looking at bringing criminal cases? Word is folks are leaving 18F to avoid prosecution. And, speaking of folks coming and going, it’s interesting to observe how 18F/TTS has been busy hiring like crazy until scent of the IG report triggered a hiring freeze a month ago. Why would you keep hiring folks when you’re only 30 percent billable–rumor has it that 18F/TTS has been busy cooking the figures of late to make it look like they’re 40-plus percent billable. We’ll look forward to reviewing the numbers from that FOIA request. And, returning to hiring practices, we understand that 18F/TTS has not been hiring folks with skill sets that map to government agency customer demand–but why would you?

Some questions we hope the IG report covers: What does 18F have to show for American taxpayers’ $100 million investment? At a recent joint GSA/MeriTalk event, David Shive, GSA CIO and acting lead for TTS and FedRAMP, said TTS will break even by 2019–and that it will lose less money than last year. So, how does TTS’ balance book look? Where are TTS’ happy government customers? How does TTS avoid competing with industry? And, of course, the big question, how should we measure success for TTS moving forward? A Government Technology article provides additional insight on 18F/TTS financials from a source inside GSA. So, MeriTalk’s not the only media platform barking up this tree.

Everybody knows government IT’s badly broken. We need new thinking that understands and respects government’s mission. We applaud the initiative that founded the Federal innovation core. Here’s hoping that GSA’s clean as a whistle.

GSA has not responded to MeriTalk’s request for confirmation and response to this story or on our previous blog post, FedRAMP Not FedRAMP’d?

“And you will know the truth, and the truth will set free you.”

John 8:32

FedRAMP Not FedRAMP’d?

Word is that www.fedramp.gov–and even the new, shiny FedRAMP dashboard–are running in a cloud without a FedRAMP ATO. Now, that’s embarrassing. We hear that this is all part of a force play by Noah Kunin, director of delivery architecture and infrastructure services at 18F/TTS. But, it’s not just FedRAMP that’s naked and afraid–it’s usa.gov, digitalgov.gov, businessusa.gov, challenge.gov, performance.gov. Oh, and to make matters more interesting, presidentialtransition.usa.gov is also on the list. In fact, 70-plus government sites, central to the digital revolution that is 18F/TTS, have no FedRAMP ATO–and may all be shuttered immediately.

Huh? Good question. 18F/TTS just received $18 million in funding from the GSA FAS Acquisition Services Fund for the new cloud.gov on a cost-recovery basis–and Mr. Kunin needs to get some paying customers to keep the lights on. Conspiracy theorists might speculate one way to do this–force workloads off the existing Content Management Platform cloud onto cloud.gov by saying CMP’s not FedRAMP ATO’d. Where’s GSA CIO David Shive in this mess? Another question: Who approved the $18 million FAS investment in cloud.gov?

Here’s another little chuckle for agencies and vendors who’ve danced with the FedRAMP/I8F monster. We understand that 18F/TTS is having issues getting its FedRAMP certification for cloud.gov. FedRAMP Accelerated was supposed to certify cloud.gov in November–but now that’s slipping to December. And, one month slip has a nasty habit of leading to another. Go sit on Father Goodrich’s knee and tell him what you want for Christmas. Open government, anyone?

Telling it Like it is: Actionable Items From CNAP 2016 and the Cybersecurity Sprint 2015

From Cybersecurity Sprint 2015 to CNAP 2016, the Federal government is building on previous cybersecurity-focused Executive Orders to bring cybersecurity to the forefront of the American public and national security discussion.

Much of the focus is in providing “experts” and “manufacturers” to help the government come up to speed and address these issues at an aggressive pace. As Einstein simply stated, “Insanity is doing the same thing over and over again and expecting different results.” Before we start, understand one thing: Einstein might have understated his premise.

The U.S. government has historically used multiple vendors to create a fair and even playing field. The creation of infrastructure and cybersecurity standards at many U.S. government facilities has created multiple gaps, voids, overlaps, and in many cases complete lack of usability. Going to the “cloud” for their resources has not appeared to fare any better with examples such as up to $1,000 to turn on or off a Virtual Machine, and one week to accomplish. Modernization and security cannot exist in this environment.

Most people will focus only on the goal without actually solving the problem, or gap. All actors need to understand what the final goal should be in order to create the best possible environment for success. The one glaring mistake that generally occurs is not having an understanding of the current situation. This is generally because vendors, IT personnel, stakeholders and even a project manager will have a microscopic view of their own “piece” of the project based on “their” product. Most vendors feel if you will only use their newest or latest and greatest “fill in the blank,” they can continue to “help you.” But, in reality, without understanding how all the pieces work together and understand where you are today, you will do nothing but create a larger problem for yourself moving forward. Speaking from more than 30 years in the industry, and building artificial intelligence ahead of the new technologies we are seeing, I can tell you without reservations, that “no one vendor has all the answers.” And if any vendor tells you they do, they are most likely lying to you.

The cybersecurity market is continuously driven by aggressive customer needs around the ability to recognize and analyze threats from outside the confines of the “classic” walls of the defined network and correlate them to the activities and resources of the users within the environment. Every day there are more than 200,000 new malwares, and more than 30,000 bad URLs being created. By the time you patch a system or purchase and install a new product, it is old or outdated. The biggest drawback is that each vendor has several “products” that work to secure pieces and parts of an environment, not end-to-end. Customers largely depend on staffs of analysts to continue to monitor threats and make changes within the environment after a threat has been determined.

If you as a customer only have $100 to spend on a solution, there are too many threat vectors, and personnel choices, to even begin to determine what might be the correct solution for you. You need to know which ones will directly affect you and your environment.

Fork lifting everything you have in your environment generally costs quite a bit of money and exchanges old problems for new ones that you may not understand, or have identified. Knowing how to install products as part of a “solution” vs. “stand alone” is the most difficult task if you are looking for best of breed, and need to work with different OEMs. First things first… PATCH YOUR ENVIRONMENT! More than 80 percent of all security breaches and vulnerabilities could be solved by simply patching your systems.

The nirvana in the industry has always been to realize threats in real time with mitigation, and adequately provided responses to these threats in real time. Therefore, applications in the sourced environment would not simply suggest, but automatically reconfigure and redeploy, the environment to maintain optimal utilization of resources while maintaining application performance.

Why are we not looking for the most probable threats today while closing gaps created from legacy products?

« Previous 1 … 7 8 9 10 11 … 20 Next »

Cookie	Duration	Description
AWSALBCORS	7 days	Amazon Web Services set this cookie for load balancing.
cookielawinfo-checkbox-advertisement	1 year	Set by the GDPR Cookie Consent plugin, this cookie records the user consent for the cookies in the "Advertisement" category.
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
CookieLawInfoConsent	1 year	CookieYes sets this cookie to record the default button state of the corresponding category and the status of CCPA. It works only in coordination with the primary cookie.
JSESSIONID	session	New Relic uses this cookie to store a session identifier so that New Relic can monitor session counts for an application.
PHPSESSID	session	This cookie is native to PHP applications. The cookie stores and identifies a user's unique session ID to manage user sessions on the website. The cookie is a session cookie and will be deleted when all the browser windows are closed.
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
_pxhd	1 year	PerimeterX sets this cookie for server-side bot detection, which helps identify malicious bots on the site.

Cookie	Duration	Description
lidc	1 day	LinkedIn sets the lidc cookie to facilitate data center selection.
li_gc	5 months 27 days	Linkedin set this cookie for storing visitor's consent regarding using cookies for non-essential purposes.
UserMatchHistory	1 month	LinkedIn sets this cookie for LinkedIn Ads ID syncing.
__cf_bm	30 minutes	Cloudflare set the cookie to support Cloudflare Bot Management.

Cookie	Duration	Description
AWSALB	7 days	AWSALB is an application load balancer cookie set by Amazon Web Services to map the session to the target.
_gat	1 minute	Google Universal Analytics sets this cookie to restrain request rate and thus limit data collection on high-traffic sites.

Cookie	Duration	Description
AnalyticsSyncHistory	1 month	Linkedin set this cookie to store information about the time a sync took place with the lms_analytics cookie.
CONSENT	2 years	YouTube sets this cookie via embedded YouTube videos and registers anonymous statistical data.
ln_or	1 day	Linkedin sets this cookie to registers statistical data on users' behaviour on the website for internal analytics.
pardot	past	The pardot cookie is set while the visitor is logged in as a Pardot user. The cookie indicates an active session and is not used for tracking.
UID	1 year 1 month 4 days	Scorecard Research sets this cookie for browser behaviour research.
vuid	1 year 1 month 4 days	Vimeo installs this cookie to collect tracking information by setting a unique ID to embed videos on the website.
_ga	1 year 1 month 4 days	Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors.
_ga_*	1 year 1 month 4 days	Google Analytics sets this cookie to store and count page views.
_gcl_au	3 months	Google Tag Manager sets the cookie to experiment advertisement efficiency of websites using their services.
_gid	1 day	Google Analytics sets this cookie to store information on how visitors use a website while also creating an analytics report of the website's performance. Some of the collected data includes the number of visitors, their source, and the pages they visit anonymously.
__gads	1 year 24 days	Google sets this cookie under the DoubleClick domain, tracks the number of times users see an advert, measures the campaign's success, and calculates its revenue. This cookie can only be read from the domain they are currently on and will not track any data while they are browsing other sites.

Cookie	Duration	Description
anj	3 months	AppNexus sets the anj cookie that contains data stating whether a cookie ID is synced with partners.
bcookie	1 year	LinkedIn sets this cookie from LinkedIn share buttons and ad tags to recognize browser IDs.
bscookie	1 year	LinkedIn sets this cookie to store performed actions on the website.
GoogleAdServingTest	session	Google sets this cookie to determine what ads have been shown to the website visitor.
IDE	1 year 24 days	Google DoubleClick IDE cookies store information about how the user uses the website to present them with relevant ads according to the user profile.
li_sugr	3 months	LinkedIn sets this cookie to collect user behaviour data to optimise the website and make advertisements on the website more relevant.
muc_ads	1 year 1 month 4 days	Twitter sets this cookie to collect user behaviour and interaction data to optimize the website.
personalization_id	1 year 1 month 4 days	Twitter sets this cookie to integrate and share features for social media and also store information about how the user uses the website, for tracking and targeting.
test_cookie	15 minutes	doubleclick.net sets this cookie to determine if the user's browser supports cookies.
uuid2	3 months	The uuid2 cookie is set by AppNexus and records information that helps differentiate between devices and browsers. This information is used to pick out ads delivered by the platform and assess the ad performance and its attribute payment.
VISITOR_INFO1_LIVE	5 months 27 days	YouTube sets this cookie to measure bandwidth, determining whether the user gets the new or old player interface.
YSC	session	Youtube sets this cookie to track the views of embedded videos on Youtube pages.
yt-remote-connected-devices	never	YouTube sets this cookie to store the user's video preferences using embedded YouTube videos.
yt-remote-device-id	never	YouTube sets this cookie to store the user's video preferences using embedded YouTube videos.
yt.innertube::nextId	never	YouTube sets this cookie to register a unique ID to store data on what videos from YouTube the user has seen.
yt.innertube::requests	never	YouTube sets this cookie to register a unique ID to store data on what videos from YouTube the user has seen.
_mkto_trk	1 year 1 month 4 days	This cookie, provided by Marketo, has information (such as a unique user ID) that is used to track the user's site usage. The cookies set by Marketo are readable only by Marketo.
__gpi	1 year 24 days	Google Ads Service uses this cookie to collect information about from multiple websites for retargeting ads.