Tag: federal agencies

  • FAA Ground Stop due to Technical Debt? | Don’t Do DIY Crypto!

    FAA Ground Stop due to Technical Debt? | Don’t Do DIY Crypto!

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: The FAA’s NOTAM database gets corrupted, and Threema shows why DIY cryptography is bad. (more…)

  • Standardizing Federal Cybersecurity With DevSecOps

    Standardizing Federal Cybersecurity With DevSecOps

    DevSecOps is having a moment in the federal government. With President Biden’s Executive Order on Improving the Nation’s Cybersecurity and federal agencies’ issuance of DevSecOps best practices based on the Enduring Security Framework, government organizations are shoring up and standardizing their DevSecOps processes to meet today’s cybersecurity challenges head-on.

    Integrating security into the development process is particularly important for federal agencies that have invested significant time, effort and money in creating and running software development factories. These agencies are actively trying to balance security and innovation–and many are succeeding. The United States Air Force’s Kessel Run program is an example of a tightly run and innovative software factory.

    The question is: How can they continue this success as the calls for standardized cybersecurity grow increasingly louder?

    The Delicate Balance Between Security and Innovation

    It’s tough to balance security and innovation and wrap them both in a standardized process. It’s certainly not impossible, as Kessel Run proves. But it does require a high level of rigor to ensure that applications are being developed at speed while taking the necessary time to mitigate and minimize security risks and vulnerabilities. 

    Projects like Kessel Run and others work well in part because they bake security into the development process from the outset. That core tenet of DevSecOps allows teams to integrate and standardize security throughout their development cycles without losing momentum. 

    But, there are challenges to these standardization efforts that are inhibiting DevSecOps practices. 

    First, many government agencies are still working with legacy systems and toolsets rather than the modern technologies that many commercial companies that employ DevSecOps have access to. These technologies can include everything from collaboration platforms, to messaging applications, to underlying platforms that tie all the work being done together. 

    Second, despite the government’s commitment to innovation, old ways of thinking still persist in many pockets of the public sector. Some important people still think, “Why change when email has worked just fine for all these years?” Those people fail to immediately see the value of modernizing their toolsets and practices.

    But outdated technologies and processes won’t help government agencies balance security and innovation–and they won’t work with new cybersecurity policies and mandates. For instance, president Biden’s EO is filled with allusions to ensuring visibility into software development practices and the software supply chain. Doing both requires developers, security managers and operations managers to be on the same page and in constant communication at all levels of the development cycle. 

    Maintaining Situational Awareness Throughout the DevSecOps Process

    Yet even in the most mature DevSecOps environments, this isn’t always possible. Because while DevSecOps is driven by collaboration, that doesn’t mean that developers, security managers, and operations managers always know who’s working on what, or what the status of a particular project is at all times. This is particularly true in a government setting where old processes, technologies, and siloed teams are still present.

    But maintaining the balance between security and innovation is highly dependent on being able to have unfettered situational awareness throughout the development lifecycle. For example, a developer needs to know if a security operations teammate is working on fixing a vulnerability the developer discovered during testing. Likewise, an operations manager needs to know the status of the patch, as that might impact other factors important to the development process, including time to deployment.

    High-level dashboards help all team members quickly ascertain the status of projects in development and are useful in helping individuals understand where things exist in the pipeline. They can provide a quick, at-a-glance take that leaders can use to plan their projects, discover backlogs or potential roadblocks to deployment, and more.

    But even dashboards are not necessarily enough, because stakeholders need to be able to quickly and securely communicate status updates to each other.

    Collecting Communications, Facilitating Collaboration

    The problem is that not all of these individuals will necessarily be using the same tools. Some might be using one messaging service. Others might be holding impromptu video meetings. Others might be posting updates to project management boards. Software development is a living and agile process, and communication is happening all the time through different channels.

    That’s why it’s critical for agencies to pull all of these disparate threads together, especially if they are to properly manage security and maintain compliance with the EO. A single missed communication about a software vulnerability could end up becoming tomorrow’s SUNBURST attack. There must be a way for all DevSecOps stakeholders to interact with each other, regardless of their choice of tools or the channels they’re using.

    This is where the choice of modern toolsets and platforms comes into play. Pulling disparate threads together to facilitate better communication and collaboration requires technologies with the ability to connect various services, automate task management and alerts, and break down any lingering communication silos. It requires an underlying architecture that connects all key stakeholders so they can collaborate and ensure the security of the applications they’re working on. 

    Meeting the Cybersecurity Moment

    Older technologies and practices aren’t up to the moment government agencies are facing. They are unsuitable for today’s software development processes, and will not aid in the quest to stay ahead of today’s cyber threats.

    To meet the moment, government agencies must embrace new ways of communicating and collaborating. They must use the tools that are available to keep innovating even while standardizing according to cybersecurity regulations. They must provide their DevSecOps teams with the ability to work freely yet securely and set them up for success.

  • Federal IT Must Embrace Automation

    Federal IT Must Embrace Automation

    In the private sector, an automation explosion is underway.

    One major retailer, for example, is using a new automated system to increase speed and accuracy in how freight is handled at its regional distribution centers. Another retail giant is relying on new automated processes to replenish store shelves more efficiently, reduce excess inventory and free employees from mundane sorting tasks.

    They are among the retailers using automation to make the networks that interconnect all their locations easier to deploy and manage. But what about federal agencies, which are among the largest enterprises in the world?

    The story there is more of a mixed bag.

    At first glance, it may seem like apples and oranges to compare government agencies with some of the world’s largest retailers. But both are responsible for serving millions of people during a time of dramatic digital advancement, which requires significant reengineering of operations, systems and processes.

    In the case of federal agencies, digital pressures have intensified as citizens have come to expect service experiences similar to those they encounter every day in the commercial sector, and as the volumes and types of data that agencies must deal with have surged.

    The Benefits of Automation

    Agencies can leverage intelligent automation for a range of benefits, from relieving employees of rote, low-value work so they can contribute in more meaningful ways to making digital services faster and more responsive through the automation of manual, backend processes.

    Let’s say, for example, that a government website serving millions of citizens is prone to slowing down and even crashing. Automated software tools that analyze huge volumes of network data can proactively identify a potential issue and fix it before it becomes a problem.

    Sounds great, right? But uptake of automation technologies in federal agencies remains a work in progress.

    A recent survey found that 63% of federal agency executives thought they could benefit from intelligent automation and that 38% have already started implementing it. However, a large number–30%–remain on the fence and said they didn’t know if automation could help them.

    Interestingly, automation’s top benefits as perceived by the survey respondents were: Moving employees away from redundant or low-value work, reducing errors and offering a better experience to citizens and other users. Reducing costs was lower on the list, which is a good sign because it shows that more in the government sector are recognizing automation’s strategic value rather than fearing it as a job killer.

    Federal Adoption of RPA

    As a reflection of how automation is changing the nature of work and making employees’ jobs more interesting and productive, the federal government has stepped up a push to adopt robotic process automation (RPA) over the last few years. RPA is a technology that uses software robots to automate highly repetitive tasks that people would otherwise perform manually. This frees up human employees for higher-value work.

    These tasks can include extraction of data from websites and email text into a structured form for processing, data reconciliation and monitoring and responding to common IT and networking issues.

    In 2018, the White House Office of Management and Budget directed federal agencies and heads of executive departments to identify more opportunities to streamline operations via RPA.

    In 2020, the General Services Administration estimated that current automation programs “operating within agencies are achieving roughly five hours of workload elimination per employee. If the government deployed RPA at scale and achieved only 20 hours of workload elimination per employee, the net capacity gained would be worth $3 billion–and that is only scratching the surface.”

    The GSA leads the federal RPA Community of Practice to help agencies overcome the technical, management, and operational challenges in designing and deploying RPA programs.

    “At a government-wide level, RPA can represent a profound change, with the potential to empower non-IT professionals and process owners with the tools to automate a significant share of their workload,” the group’s report said. “RPA is considered transformative because it establishes the building blocks for artificial intelligence in terms of information technology infrastructure and task standardization. With effective RPA deployment, machine learning and intelligent automation are only a few, manageable steps away.”

    According to the group, “many agencies across the federal government have initiated RPA programs to automate tasks of varying complexity. Automations developed to date have focused on multiple functional areas including finance, acquisition, IT, human resources, mission organizations and security/mission assurance.”

    My own experience in working with federal customers is that many are at least dipping their toes into the automation waters, but not quickly enough and certainly not at the pace seen in some parts of the private sector.

    Why the continued reluctance? I think much of it comes down to trust. Worries remain that automation will take jobs when, in fact, machines should be thought of as non-human team members who take care of the drudgery while the humans contribute their knowledge and creativity to more important work. Federal enterprises should embrace the opportunity to test automation to prove it works as they expect, similar to interviewing a new employee. This is how to gain the trust needed to deploy automation to augment humans’ work.

    Automation also faces resistance from older employees who, on the verge of retirement, aren’t interested in learning new technology.

    The fact is, though, the federal government is on the cusp of an automation boom. More and more, it will become critical to agencies’ success. The time for fear and mistrust is over.

    Automation is here to stay, and agencies should embrace it.

  • Why DevOps and Federal Agencies Need Each Other

    Why DevOps and Federal Agencies Need Each Other

    In times of crisis, the U.S. government needs to bring in tech tools fast to help solve the problem.

    First, now is a vulnerable time and weaknesses are exposed in telework infrastructure as the government rapidly shifted to remote work. Cyberattacks are up as adversaries try to exploit the weaknesses. Second, federal agencies are also overloaded with traffic, to the point that their technology is reaching a breaking point.

    DevOps and DevSecOps may be the key to solving these issues for government agencies. Both, DevOps and DevSecOps, ensure delivery of a product is fast, secure and constantly evolving, which is vital to helping the U.S. government maintain continuity during the ongoing pandemic and set up future stability.

    The Air Force experienced these benefits firsthand when its internal DevOps team pushed out at least 10 updates a day, sometimes up to 30, and sustained that agile standard for some time. This agility, security and speed allows the Air Force to focus on the end-users and mission owners.

    If the government doesn’t have DevOps, it will lack the foundation needed to build a strong tech stack and work with other emerging tech solutions.

    DevOps Use Cases in Government

    With the government workforce spread out geographically, government networks are experiencing an increase in users plugging into virtual environments. Continuous patches and updates keep government systems and networks secure, functional and able to handle the load that comes with a surge of users. DevOps ensures the government has the tools and processes in place to support growth and prevent network failure under the additional stress of onboarding thousands of users each day.

    The government also needs tools that can help the distributed workforce maintain continuity, especially when it comes to security, operations and maintenance. Employees need correct access to do their jobs, but agencies must maintain control over what data is shared and how to confirm users are who they claim to be. Access management is vital in remote environments to ensure tighter control over who has privileged access.

    A modernized approach to privileged access tools means developers can hit targets of continuous delivery to improve systems and security. Otherwise, exploitable vulnerabilities are exposed to bad actors. Solutions for secure privileged access, especially across a distributed workforce, are key to scaling tech across government.

    With a hasty shift to remote work also comes change management, which is already difficult, not to mention the additional strain of a pandemic. In a crisis, federal agencies can’t wait for in-house solutions that take a long time to develop. The government needs commercial tech that can help build remote infrastructure.

    Federal Market Opportunities

    As the government responds to COVID-19, federal agencies are in search of technologies and tools that can support their missions. Many agencies are feeling immediate strain on their IT systems as part of the shift to telework, and have received reallocated and additional budget — with broad latitude on how they spend — and procurement flexibility to modernize their systems. This opens up opportunities for tech companies, like those in the DevOps and DevSecOps space.

    Tech companies that already work in the federal market know that while the government procurement process can be lengthy and complex, it can be well worth the effort for stable revenue. In times of economic uncertainty, working with the federal market can help companies build recession resilience.

    Another part of the opportunity now is that the government needs flexible and scalable technologies that can help them respond to the COVID-19 crisis, but first, they need DevOps tools for a strong foundation and infrastructure.

    The government needs DevOps and DevSecOps now more than ever, and there are commercially successful tech companies that can help with exactly that today. In return, the government can provide a sustainable source of revenue for emerging DevOps companies. Working together can be a win-win for these tech companies and federal agencies, and can help move us toward a more innovative, safer and healthier future.