DevOps Shines as Federal IT Modernization Efforts Grow

From time to time GovEvents will come across information we feel our members and audience would benefit from. Here's something we wanted to share:

The Modernizing Government Technology Act (MGT) and other related initiatives are pushing agencies to move away from aging, legacy applications as well as costly, complex software projects. The goal is to have more secure, agile, and cost-effective IT infrastructures replace them.

DevOps, a moniker that is a combination of development and operations, is emerging as an approach that could help Federal agencies modernize and speed new development efforts, especially as they migrate to cloud services. DevOps is a software engineering culture as well as a practice that advocates automation and monitoring throughout the software development lifecycle. It generally pairs development teams with IT operations throughout the development cycle, eliminating the somewhat adversarial role that sometimes has naturally formed in many organizations. Continue reading

MGT Passed-So What Now?

From time to time GovEvents will come across information we feel our members and audience would benefit from. Here's something we wanted to share:

The Modernizing Government Technology (MGT) Act became the law of the land on Dec. 21, when President Trump signed it into law as part of the National Defense Authorization Act (NDAA). This is the much-vaunted revolving capital fund-cut out of the original FITARA bill in committee-that establishes a central bucket of money at the Office of Management and Budget (OMB), managed by the General Services Administration (GSA), for Feds to modernize legacy IT systems. Great idea when you consider that the Government Accountability Office (GAO) tells us Uncle Sam owns 777 supply chain systems and over 600 HR systems-and in light of the fact that we spend 80 percent of the $80-120 billion annual IT budget on life support for geriatric systems that should long since have been euthanized...

Show Me the Money.

However, while MGT is now the law, what does it really mean? This is an interesting question. Recent talk of MGT has trumpeted the $500 million central revolving capital fund-exciting, but a long step down from the $3.1 billion IT modernization piggy bank originally attached to FITARA. That said, it's significant to note that while the MGT Act made it into law, appropriators sat on their hands. Yes, believe it or not, there's no funding for MGT at this time. And, interestingly, there's a discrepancy between the bill, that authorizes $250 million each year in FY18 and FY19, and President Trump's budget request for MGT FY18, which was $228 million.

So, MGT NBD? Absolutely not. And, here's why... Continue reading

Time to Get Serious About Federal Government Cybersecurity

From time to time GovEvents will come across information we feel our members and audience would benefit from. Here's something we wanted to share:

It is generally accepted that, as the National Institute for Standards and Technology points out, cybersecurity threats exploit the increased complexity and connectivity of our critical infrastructure systems and can potentially place the nation's security, economy, and public safety and health at risk. Like financial and reputational risk, cybersecurity risk affects the bottom line of both companies and nation-states. It can drive up costs and impact revenue. It can harm the ability to innovate and to gain and maintain customers, as well as make it difficult to meet the needs of citizens.

To address these risks, President Obama issued Executive Order 13636, "Improving Critical Infrastructure Cybersecurity," on Feb. 12, 2013. According to the Department of Homeland Security, this executive order directed the executive branch to do five things: develop a technology-neutral voluntary cybersecurity framework; promote and incentivize the adoption of cybersecurity practices; increase the volume, timeliness, and quality of cyber threat information sharing; incorporate strong privacy and civil liberties protections into every initiative to secure our critical infrastructure; and explore the use of existing regulation to promote cybersecurity.

Almost exactly one year later, a cyber intrusion began at the United States Office of Personal Management. This intrusion went undetected for 13 months. As the Wall Street Journal, U.S. News & World Report and other media reports noted, this intrusion was described by Federal officials as among the largest breaches of government data in the history of the United States. Information targeted in the breach included personally identifiable information, such as Social Security numbers, as well as names, dates, places of birth, and addresses. The hack even involved the theft of detailed security clearance-related background information, including more than 5.6 million sets of fingerprints.

Clearly, EO 13636 was insufficient to prevent a major cybersecurity event.

Less than a month ago, President Trump signed a new executive order, "Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure," designed to protect American innovation and values. This new executive order, which reflects considerable analysis, opens with four findings: that the executive branch has for too long accepted antiquated and difficult-to-defend IT; that effective risk management involves more than just protecting IT and data currently in place; that known but unmitigated vulnerabilities are among the highest cybersecurity risks faced by executive departments and agencies; and that effective risk management requires agency heads to lead integrated teams of senior executives with expertise in IT, security, budgeting, acquisition, law, privacy, and human resources.

The executive order goes on to explicitly hold agency heads accountable to the president for implementing risk management measures commensurate with the risk and magnitude of the harm that would result from unauthorized access, use, disclosure, disruption, modification, or destruction of IT and data. It also mandates the use of the rigorous and recently revised Framework for Improving Critical Infrastructure Cybersecurity developed by the National Institute of Standards and Technology that EO 13636 deemed voluntary.

Will this new executive order make a difference? The answer may rest in the implementation and enforcement of the order. With parallel progress in both pattern recognition algorithms and microelectronic technology, machine learning and artificial intelligence can likely already bridge the gap between the enormous volume of government intelligence data and people capable of analyzing it, as Jason Matheny, Director of the Intelligence Advance Research Project Agency, has forecast. IBM's Watson, for example, can understand all forms of data, interact naturally with people, and learn and reason at scale. Accordingly, the compromise of even sensitive but unclassified information when analyzed by sophisticated means could enable perpetrators to "connect the dots" and jeopardize national security.

In this environment, will "mistakes" or negligence leading to compromised information be tolerated or will they be dealt with severely? Will agency heads be held accountable or will they get a pass? Will "antiquated and difficult-to-defend IT" be tolerated or will rigorous processes and modern applications, like layered security, limitations within network security, encryption of data at rest and in motion, and policy engines used in conjunction with access restriction and auditing software be mandated, implemented, and audited?

The answers will be revealed over the next weeks and months.

The challenge is clear--a well-thought-out and rigorous policy for Federal government cybersecurity is in place, now it must be implemented and enforced. Time is not on our side; the next hack or the next serious incident due to the negligence of a government employee or contractor could happen tomorrow or the next day. It is time to get serious about Federal government cybersecurity.

View original post on MeriTalk