Nuclear agency’s top IT official: ‘Industry has not done enough’ on security

The top IT leader at the Department of Energy’s National Nuclear Security Administration is questioning the role of technology providers when it comes to the security and risk mitigation tied to their solutions. 

“Industry has not done enough,” CIO James Wolff said during the Billington CyberSecurity Summit in Washington, D.C., on Wednesday. “A lot of this is getting pushed on the consumer.” 

Perhaps always, but especially recently, the federal government has leaned into its partnership with industry to bridge technology gaps. As agencies work to untangle tech debt, vendors step in to ease the process. And when emerging technologies gain traction, vendors facilitate adoption. 

But the deepening reliance on industry has also exposed points of tension.  

“You all use these same tools, too, in your companies,” Wolff said. “You face the same risks as we do, so as customers, why are we facing a risk?”

“The industry, the people that are producing the tools, should be producing tools that are more secure,” he added. “So it’s really like, how do we work together? How do we put the risk and the responsibility in the right place? And I do believe that we, as customers, are getting more of that right now than the people that produce the system.”

NNSA has a high-stakes mission, responsible for ensuring the United States has a safe, secure and reliable nuclear stockpile and maintaining America’s shield against nuclear and radiological attacks. Vendors that NNSA brings on board have to live up to that weighty responsibility. 

In addition to security and adequate risk management, clear communication is another one of the minimum requirements. 

“For some reason, we’ve gotten to the point where liability, public perception [and] all of these things are taking a higher priority than basic communication with customers,” Wolff said. “Why is a company not telling us about an issue or a breach until it’s in the news? That’s unacceptable.” 

In the midst of friction, NNSA is working to beef up its vendor-vetting skills. 

The federal government has levels of quality assurance mechanisms to ensure systems work as expected, but NNSA handles the “programmatic side” of whether it has confidence in the vendor as a company. The semi-autonomous agency within DOE has historically relied on databases and a handful of companies to determine if a vendor could be considered risky. 

AI may soon have a role in the process, too. 

“Some of our early experimentation is that AI has proven to be at least additive, if not potentially disruptive in that space, which is good for us,” Wolff said. “That means we may end up having to pay less for a service.” 

Still, there’s benefit to having a layered approach to vendor vetting, per the IT leader. 

A small firm recently helped NNSA uncover an “incredible risk” during a vendor analysis that had not been previously identified during other checks. The flagged vendor was a system provider, Wolff told FedScoop on the sidelines of the event. 

“We’re divesting from it, but much of the rest of the government and the economy is tied to that risk,” Wolff said of the flagged vendor. 

As AI is added to the vetting process, Wolff said the anecdote serves as a reason to still lean on human expertise.

“We have to balance what automated means can tell us … [with] also that deep dive, deep expertise into what risk means,” he said. “That’s incredibly important.”