Strengthening Internet of Things Security at the Federal, Local, and Consumer Level

"Our world is more connected than ever." This phrase can be interpreted in many ways, one being the growth of Internet of Things (IoT) devices. Traditional materials and devices, including bridges, streetlights, water processing machines, home refrigerators, and even our doorbells, are now connected to the internet and to users who need to track how they are functioning. However, this cyber connection also means that these devices are open for others to access and use in ways we never envisioned.

Cybersecurity practices must now extend to non-cyber products to ensure that operational technology does not compromise information technology or the networks that connect them. In fact, 1.5 billion attacks were launched against IoT devices in a single year.

Efforts to secure IoT devices must happen across all levels of users, from the federal government through state and local agencies to even citizen consumers. Continue reading

FITARA Goes to the Cloud, Grades Come Down to the Ground

The 17th edition of the Federal Information Technology Acquisition Reform Act (FITARA) scorecard featured a revamped list of measurements to illustrate federal agency progress against current modernization goals. This latest scorecard introduced two new categories - Cloud Computing and CIO Investment Evaluation - while dropping the measurement of compliance with data center modernization, something all agencies have completed.

This reshuffling of measurement criteria resulted in lower grades for 11 agencies. Twelve agencies saw their grades unchanged. The Department of Defense (DoD) was the sole group earning a higher grade, rising from a C to a B. These drops are not necessarily a concerning indicator, but rather a re-baselining of where agencies stand in terms of modern digital government goals. Continue reading

Creating an Inventory of Tech and People for More Secure Systems

Moving to a zero-trust model for cybersecurity is dependent on understanding who and what needs access to your network. While simple to say, it is not as simple to do. Government agencies are currently focused on ensuring they have the full picture of what is on the network and who they need to support securing those assets.

Defining the Ecosystem

As agencies progress on their zero-trust journey, understanding every piece that touches networks becomes critical. These touchpoints often extend beyond traditional technology solutions. The growth of Internet of Things (IoT) devices introduces operational technology into the IT architecture.

Edge computing devices being used by field staff, sensors, and cameras all provide valuable data and efficiency, but they also provide an entry point for bad actors. Because of this, the Office of Management and Budget has tasked agencies with creating an IoT Inventory by the end of fiscal 2024. The memo details the breadth of devices to be inventoried, including building maintenance systems, environmental sensors, specialized equipment in hospitals and laboratories, and more. With this inventory in place, agencies will be able to take advantage of a new working group on the CISO Council, which will define IoT and OT security best practices.

New Approach = New Talent

With cybersecurity permeating every aspect of government operations - from traditional IT to the operational systems mentioned above - we need to take a look at how we train the federal workforce. With a recognized cybersecurity skills gap, new efforts are underway to grow a workforce trained and able to take on cybersecurity challenges.

  • The Federal Cybersecurity Workforce Expansion Act has been introduced to grow the federal cybersecurity workforce through the creation of several programs including a focus on providing cybersecurity training to veterans.
  • Keeping cyber talent in government is just as critical as training new talent. The Office of Personnel Management has created the cyber rotational program to allow federal employees to move to details at other agencies, providing the opportunity for growth within the federal government.
  • The National Geospatial-Intelligence Agency is building its cyber ranks with the next generation. It created a program to hire high school students as interns and give them top-secret security clearances to work on mission-critical work.

GovEvents and GovWhitePapers have a host of resources that detail how agencies can get a handle on the things they need to secure and the people they need to do that work.

  • Identify, Evaluate & Prioritize Industrial Cyber Risk (January 10, 2024; webcast) - Industrial control system (ICS) security represents one of the more challenging areas for security professionals. It's often a legacy system that wasn't designed with security in mind and, because it's different from traditional IT assets, it has very different security requirements. And no surprise--such systems are increasingly targeted by sophisticated cyberattackers, including ransomware gangs and nation-state actors. Learn how to harden OT assets against cyber-threats, identify critical endpoint vulnerabilities and risks, enable rapid recovery, and more.
  • Bridging the Cybersecurity Talent Gap in Government (January 11, 2024; webcast) - Navigating the unique challenges of the government and public sector demands a specialized approach to cybersecurity talent. This session will unveil groundbreaking methods, from upskilling your current team to leveraging a pre-vetted cybersecurity talent pool. It will also explore government-funded cybersecurity training programs to enhance your workforce.
  • Federal News Network's Industry Exchange Cyber (January 22, 2024; webcast) - Gain a perspective on cybersecurity issues critical to government: intelligence, endpoint management and remediation, identity security, cybersecurity asset management, and security orchestration and response.
  • CyberSmart 2024: Cybersecurity Faces a Rapidly Changing Landscape (January 25, 2024; Reston, VA) - Just as agencies are implementing zero-trust architecture to help with this wave, other IT developments are threatening to upend cybersecurity even more. Artificial intelligence is being incorporated into software, even as elected officials and regulatory agencies are trying to develop new rules of the road for its use. At the same time, historically offline operations technology is beginning to be integrated with IT systems, opening up the OT to attacks that previously weren't feasible.
  • Cybersecurity (white paper) - The increasing use of communication technologies relying on complex data, technology, communication, and interconnectivity has expanded attack surfaces and increased the potential risk of malicious exploitation. The Department of Homeland Security Science & Technology's Cybersecurity Program leverages multidisciplinary expertise to research, analyze, and develop cutting-edge cybersecurity technologies and capabilities to improve the protection and resilience of our national critical infrastructure and federal and state departments and agencies.
  • Accelerate Cybersecurity Mandate Compliance (white paper) - In the push to comply with a multitude of cybersecurity mandates, federal agencies are faced with challenges of cost, complexity, and delays to achieve full compliance. Failure to fully implement the requirements of these mandates, however, is not an option when critical infrastructure, public services, and national security are at risk from an ever-expanding threat landscape.
  • Building the Cybersecurity Workforce Pipeline (white paper) - This report analyzes the National Centers of Academic Excellence in Cyber (NCAE-C), a consortium of institutions designated as centers of excellence by the National Security Agency, to determine how NCAE-C designated institutions fare compared to other schools in graduating students with cyber-related degrees and credentials.

For more on the government's path to zero trust, explore the resources available on GovEvents and GovWhitePapers.

The Next Generation of Government

While the feared "silver tsunami" of retirements never really transpired, the government workforce is worryingly aging. More than 70% of the federal workforce is age 40 or older. In the general workforce, only 54% are 40 or older. This skewed population is not only worrisome in terms of retirements interrupting continuity, but also introduces a huge risk in terms of diversity. Younger workers may lack experience, but they bring with them a perspective that is critical in designing services and solutions that meet the needs of citizens under 40. Younger workers may also have more up-to-date training in leading-edge technologies currently being deployed across government.

The public service call of government is a huge plus for younger workers who want a job where they can make a difference and find meaning. However, the outdated, lengthy hiring process and pay scales keep many from applying. These and other recognized barriers are being addressed across government to inject youth into the federal service workforce. Continue reading

GSA freezes per diem rates at 2012 levels

Originally posted by Kellie Lunney on Government Executive

Government travel per diem rates will not change in fiscal 2013, according to the General Services Administration.

GSA announced Tuesday that it will freeze fiscal 2013 travel reimbursement rates for lodging and other related expenses at fiscal 2012 levels. The move is part of the Office of Management and Budget's directive to agencies to reduce all travel spending in fiscal 2013 by 30 percent compared to fiscal 2010.

"By keeping per diem rates at current levels, we are supporting federal agencies in controlling costs and ensuring that taxpayer dollars are used wisely," acting GSA Administrator Dan Tangherlini said in a statement.

Continue reading