OMB directs agencies to increase log sharing to combat cyber incidents

The Office of Management and Budget directed federal agencies to increase their sharing of information system logs needed to accelerate cybersecurity incident response, in a memo issued Friday.

The memo contains a maturity model for event log management intended to guide agencies implementation of its requirements across four event logging (EL) tiers: not effective, basic, intermediate, and advanced.

Following the SolarWinds hack that compromised agencies, President Biden issued a cybersecurity executive order — Section 8 of which lays out logging and log retention. The EO also outlined the management requirements that OMB‘s memo addresses.

“Recent events, including the SolarWinds incident, underscore the importance of increased government visibility before, during and after a cybersecurity incident,” reads the memo. “Information from logs on federal information systems — for both on-premises systems and connections hosted by third parties, such as cloud services providers — is invaluable in the detection, investigation and remediation of cyber threats.”

OMB expects agencies to prioritize their high-impact systems and high-value assets first as they implement EL requirements.

The first maturity model tier, EL0 or not effective, allows for agencies to meet or partially meet requirements of the highest criticality — namely retaining criticality level 0 logs in acceptable format for timeframes specified in the memo.

By EL1, or the basic tier, agencies must fully meet requirements of the highest criticality: the basic logging categories; minimum logging data; time standard; event forwarding; protecting and validating log information; passive Domain Name System; Cybersecurity and Infrastructure Security Agency and FBI access requirements; logging orchestration, automation and response planning; user behavior monitoring planning; and basic centralized access.

EL2 adds intermediate criticality requirements: meeting the EL1 maturity level; intermediate logging categories; publication of standardized log structure; inspection of encrypted data; and intermediate centralized access.

Lastly EL3 requires meeting the EL2 maturity level; advanced logging categories; finalizing implementation of logging orchestration, automation and response; finalizing implementation of user behavior monitoring; application container security, operations and management; and advanced centralized access.

Agencies have 60 days from the memo’s issuance to assess their logging maturity against the model and plan to address resource and implementation gaps. Those plans must be sent to the OMB Resource Management Office and Office of the Chief Information Officer desk officer.

In a year agencies must achieve EL1 maturity, in 18 months EL2, and in two years EL3.

Agencies must also provide relevant logs to CISA and the FBI upon request, as well as share them as needed with other agencies in addressing cyber risks or incidents.

“This sharing of information is critical to defend federal information systems,” reads the memo.

The memo directs CISA to deploy teams to advise agencies in their assessment of their logging capabilities and release tools with the FBI to help assess logging maturity.

Meanwhile the Department of Commerce must have the National Institute of Standards and Technology maintain Special Publication 800-92, its “Guide to Computer Security Log Management” and incorporate the memo’s requirements into its next revision and other relevant publications.

State Department awards AT&T $609M task order

AT&T has won a potential $609 million telecommunications contract from the State Department under the governmentwide Enterprise Infrastructure Solutions (EIS) contract.

Under the terms of the procurement, the company will provide telecom support to more than 270 U.S. diplomatic locations around the world over a five-year period.

AT&T is tasked with providing enterprisewide connectivity for data, mobile and voice networks, unified communications and Wi-Fi services.

Chris Smith, vice president of civilian and shared services at AT&T, said: “As the incumbent telecommunications provider to the State Department, their new contract award to us is a vote of confidence in the reliability and performance of our teams, our networking capabilities and the value we deliver in service of their mission.”

In June, AT&T received a separate $725 million EIS task order from the Department of Veterans Affairs to modernize the department’s data communications platform.

That contract win followed another $306 million EIS award from DHS of four task orders for modernizing telecommunications infrastructure with internet protocol-based networking services.

EIS is the government $50 billion network and telecom modernization contract managed by the General Services Administration that requires agencies to move away from expiring legacy contracts by Sept. 31, 2022.

Department of Defense 5G lead Evans steps down

Joseph Evans, the Department of Defense’s principal director for 5G technology, has left his post at the Pentagon.

He departs after two years in the position, during which time he oversaw the development of the DOD’s 5G strategy, implementation plan and established major public-private partnerships.

Following Evans’ exit, Amanda Toman is understood to have taken up the role of acting principal director for 5G.

Prior to joining the Office of the Undersecretary of Defense for Research and Engineering in August 2019, Evans was a program manager at DARPA. Earlier in his career, he also worked as a program manager at the National Science Foundation, according to his LinkedIn profile.

“We now have 5G testbeds under construction or soon to start deployment at over 15 DoD facilities around the country, and these testbeds will give the U.S. military the ability to prototype new 5G applications for military missions,” Evans wrote in a farewell post on LinkedIn.

The public-private partnerships Evans oversaw issued more than $600 million to companies willing to test new tech on military bases. The exchange allowed 5G developers to trial new networks in low-regulation environments like military bases, and thus allow the DOD to have first access to using the tech.

The strategy involves both advancing the DOD’s own use of the tech but also giving private companies the opportunity to advance a technology that the U.S. has identified as being critical for strategic competition with China.

Department of Veterans Affairs appoints Neil Evans as acting CIO

The Department of Veterans Affairs has appointed Neil Evans as acting chief information officer.

He takes over the role from Dominic Cussatt, who is understood to have left the agency to join the State Department.

An agency spokesperson said Cussatt has assumed a dual role at State, holding the positions of both chief information for the Bureau of Intelligence and Research (INR) and director of the INR Office of Technology and Innovation.

Evans was previously chief officer of the agency’s Office of Connected Care and takes up the job after a two-decade career at the VA. He continues to work as a physician, and previous roles include a stint as a senior adviser to the Federal Electronic Health Modernization Program Office.

While Evans takes the role of VA CIO in an acting capacity, in an official capacity it requires presidential nomination and Senate approval.

Earlier this year, Cussatt became acting CIO at VA following the departure of former CIO James Gfrerer, who left in January at the start of the Biden administration. Earlier in Cussatt’s two-decade career spanning the public and private sectors, he worked as national co-chair of the NATO Information Assurance and Cyber Defense Capability Panel, and as deputy CISO at the Department of Defense.

A VA spokesperson confirmed Evans’ appointment.

Note: This story was updated to include details of Cussatt’s new appointments at the State Department.

DHA awards $2B health IT transformation contract

The Defense Health Agency has awarded a $2 billion contract to manage the transformation and consolidation of its IT services.

Peraton subsidiary Perspecta is the principal contractor on the firm-fixed-price blanket purchase agreement. It will carry out the contract with help from Capgemini Government Solutions as part of a contractor teaming arrangement.

The agreement is for 10 years and is part of an integration program that is intended to cut costs. The deal includes the transition of certain existing enterprise contracts, of which the largest is the DHA Global Service Center service desk.

This is the latest contract win for Peraton after the company earlier this month won a task order worth up to $979 million to counter misinformation from U.S. adversaries.

At the start of August, Peraton also won an IT infrastructure contract from the Department of Veterans Affairs that could be worth up to $497 million over seven years.

Earlier in February, the IT arm of defense contractor Northrop Grumman merged with Peraton for $3.4 billion. Peraton is owned by private equity group Veritas Capital, which has sought to acquire and roll up government technology operations. In January it paid $7.1 billion to purchase Perspecta in an all-cash transaction.

White House launches US Digital Corps

The White House launched a two-year fellowship Monday designed to place early-career software engineers, data scientists and other technologists at federal agencies.

Dubbed the U.S. Digital Corps, participants will improve IT service delivery in relation to the federal coronavirus response, economic recovery, cybersecurity and agencies’ individual missions.

The Day One Project proposed the fellowship back in December as a way to eventually recruit thousands of recent graduates across technical fields, in what could become the Biden-Harris version of President John F. Kennedy’s Peace Corps or President Franklin D. Roosevelt’s Civilian Conservation Corps, said Nick Sinai, former federal deputy chief technology officer under President Obama.

“We have great opportunities for experienced tech talent to serve in term-limited roles in government like [the U.S. Digital Service], 18F and [Presidential Innovation Fellows],” Sinai said. “But we haven’t focused on getting talented technologists into government at the start of their career; the Digital Corps can change that.”

The Digital Corps will be housed within Technology Transformation Services at the General Services Administration, which partnered with the Office of Management and Budget, Office of Personnel Management, Cybersecurity and Infrastructure Security Agency, and Office of Science and Technology Policy to deliver the program. The collaboration is notable as GSA, OMB and OPM aim to restore trust in their working relationship, as is CISA’s involvement because USDS, 18F and the PIF program aren’t as focused on security.

An initial cohort will launch with 30 fellows in the fall at more than five participating agencies including GSA, the Department of Veterans Affairs, the Centers for Medicare and Medicaid Services, and the Consumer Financial Protection Bureau. Fellows will be matched with agencies based on their skills and interests and mentored through a development curriculum with individual performance plans.

Traditionally government has focused on credentials, but skills will matter more than a degree for the Digital Corps. Recruits will come from both leading undergraduate programs and alternative training pathways like apprenticeships, bootcamps and certificate programs to make the cohort as diverse as possible. Currently, only 3% of the federal tech workforce is under age 30, and only 26% are women.

“To provide best-in-class service delivery, agencies must have the right combination of workforce talent in place as their existing personnel accelerate towards retirement,” said Clare Martorana, federal chief information officer, in a statement. “The U.S. Digital Corps is a forward-looking solution that will build a deep bench for technology modernization and digital transformation across the federal government and meet the Biden administration’s goals of advancing federal IT and cybersecurity.”

The Digital Corps was inspired by nonprofit Coding It Forward’s Civic Digital Fellowship, which has placed more than 300 collegiate technologists at 12 agencies. Co-founder Chris Kuang and Caitlin Gandhi transitioned to GSA to build the fellowship.

Applications open in the fall.

“The launch of the Digital Corps comes at a time when more and more technologists want to contribute to the public good,” said Jen Pahlka, former deputy federal CTO. “Many are disillusioned with the opportunities of big tech and want to do things like ensure that eligible people get food assistance or veterans benefits or speed up visas for refugees into the US.”

Army seeks vendors for $10B IT Enterprise Solutions-4 hardware contract vehicle

The Army has issued a solicitation for IT hardware services that will award technology providers up to $10 billion over a 10-year period.

The military service is seeking vendors for services and technology, including the purchase and lease of commercial servers, computers, networking hardware and storage equipment.

At least 17 indefinite delivery, indefinite quantity contracts will be awarded, and services must be delivered both within and outside the continental United States.

“The fundamental purpose of the ITES-4H acquisition is to support the Army enterprise infrastructure and infostructure goals with a full range of innovative, world class information technology equipment and solutions at a reasonable price,” the solicitation document said.

Contracts issued through the vehicle with have a base period of five years, with an additional five-year option.

The solicitation follows a $2.4 billion contract, awarded by the service in July, for IT services to its National Cyber Range Complex.

Space Force needs to make acquisition a critical capability, study says

One of the keys to an agile Space Force acquisition system is to remove barriers between operators and buyers and treat acquisition as a core function of the newest military branch, a study from the RAND Corporation suggests.

The study lists other recommendations, including increasing the volume of information that is shared with industry, and giving decision-making subordinates more autonomy. The Space Force has been working on a new method of acquisition to try and avoid the pitfalls of the industrial processes other military services use, which have been criticized for their sluggish pace and lack of ability to keep up with tech innovations.

The Space Force “is highly reliant on technology, even more so than other services,” the study states. “This dependence on technology necessitates [the Space Force] having a close, trusting, collaborative relationship with industry.”

Senior space leaders have echoed the call for an agile system that can keep pace with tech, saying that one of the advantages of starting a new service is the ability for it to chart its own acquisition path.

“We are a startup company ourselves,” Gen. John Raymond, chief of space operations, told lawmakers in March 2020. “We have to go at speed.”

Other key recommendation from the 87-page report include having a work force of “experts,” having an adaptive technical architecture that defines the overarching needs of the force and hosting “on-ramp” events to test new tech from industry. Overall, there needs to be trust between government and the private sector, the report adds.

“To effect real change, acquisition needs to be reimagined and understood as a warfighting capability critical to the mission,” the study states.

The Space Force remain responsible for its own acquisition strategy, a plan that member of Congress have been waiting to see. Some key lawmakers have expressed disappointment in the lack of progress by the Space Force on that strategy.

Frank Kendall, secretary of the Air Force and top civilian that oversees the Space Force, recently merged Air Force acquisition offices to focus on space. He moved the Space Acquisition Directorate, which was nested in the acquisition, technology and logistics office, into the Space Acquisition and Integration Office, he announced Tuesday.

“One area where we have not done enough yet is in the acquisition capacity of the Department of the Air Force,” he said during the Space Foundation’s Space Symposium Tuesday.

Cyber experts seek clarity on NIST supply chain framework

Cyber experts agree a technology supply chain security framework developed by the National Institute of Standards and Technology will be a useful tool for agencies and industry. They are less sure about what it will look like.

The White House gave few details in the fact sheet it released — following President Biden‘s Wednesday meeting with private sector and education leaders on improving national cybersecurity — other than the guidance will address building and assessing the security of technology like open-source software.

NIST‘s existing Cybersecurity Framework (CSF) includes a supply chain risk management category under the identify function, but there are only five, high-level subcategories. Other NIST publications on the subject are highly technical, and the Cyber Supply Chain Risk Management (C-SCRM) project updated practices earlier this year.

“For me, I was left a little bit frankly confused because there’s already some supply chain stuff out there, though it’s not set up like the NIST CSF,” Malcolm Harkins, chief security officer of Epiphany Systems, told FedScoop. “So I would contemplate that they’re trying to take that existing C-SCRM set of practices, and research and assurance suggestions, and perhaps turn it into something like the CSF.”

The prevailing theory is the new framework will focus primarily on the software supply chain —in light of the recent Microsoft Exchange server attacks, Kaseya ransomware attack and SolarWinds breach — with hardware practices thrown in.

A framework that fleshes out NIST’s security measures for software acquisition would give the government more leverage with providers.

“Open-source vulnerabilities, just in general, are pretty huge, and a lot of the software providers out there use open sources like components,” said Padraic O’Reilly, Pentagon advisor and cofounder of CyberSaint. “So there’s demand for increased transparency around that, and that’s also part of what NIST is working on.”

Harkins wants to see the information supply chain finally addressed by NIST’s framework as well because, if the flow of information is poisoned or altered, it can have cyber consequences.

He likens it to knowing whether meat in a grocery store is safe, which can only be assured if the supply chain of information about the product is secure from the slaughterhouse to the point of sale.

“Historically they’ve stayed with the software side or the hardware side of it,” Harkins said. “I would love to see them expand into the supply chain of information flow because I growingly worry about integrity attacks in the flow of information.”

For its part, NIST isn’t saying much — as it just kicked off the effort.

“We will keep the public updated as we have more to announce,” said a NIST spokesperson. “This effort is separate from the NIST Cybersecurity Framework, but we envision they will be complementary.”

The White House fact sheet listed Microsoft, Google, IBM, Travelers, and Coalition as partners collaborating on the framework. Microsoft and IBM didn’t have anything more to add to the release, and Google did not respond to a request for comment.

Travelers Chairman and CEO Alan Schnitzer called the initiative “an important step in enhancing the nation’s overall cybersecurity,” in a statement.

CEO of Coalition, Joshua Motta, said the cyber insurance company would work with government and industry partners to help formulate the new NIST standards. “[W]e hope to create guidelines on how to build secure technology and assess the security of technology to provide organizations with a foundation for how to minimize their cyber risk,” he said.

Harkins worries the weight big players like Microsoft and Google have in the compute environment might introduce bias into the overall supply chain approach and hopes NIST reaches out to small and midsize businesses like Epiphany. Those businesses are often more innovative because they’re less risk averse and less worried about profit loss, he said.

O’Reilly cautioned the White House’s “aggressive” timeline to have agencies identify their critical software isn’t “terribly realistic,” as only some agencies have started. While those timelines may need to be revisited, there’s no reason NIST shouldn’t be pushed to publish its much-needed framework.

“It’s got to be expedited,” O’Reilly said. “So you can’t have the same timeline you had with the CSF or the questions around measurement.”

Note: this story was updated to include comment from Coalition.

DHS creates Cybersecurity Service similar to DOD’s Cyber Excepted Service

The Department of Homeland Security has created the DHS Cybersecurity Service, a new way to hire and manage cybersecurity professionals outside of traditional civil service requirements.

DHS announced the Cybersecurity Service as part of its long-awaited Cyber Talent Management System in an interim final rule published Thursday in the Federal Register.

Personnel hired to the DHS-CS will take what the department is calling qualified positions — excepted service roles with their own qualification requirements and that are not subject to the appointment, pay, and classification rules of traditional competitive service positions, based on special hiring flexibilities. The Department of Defense has its own Cyber Excepted Service initiative based on similar hiring flexibilities to make itself more competitive and quick in hiring and managing civilian cybersecurity talent to its forces.

“The goal of the DHS-CS is to enhance the cybersecurity of the nation through the most effective execution of the DHS cybersecurity mission,” the rule says. “DHS will use [the Cyber Talent Management System] to hire, compensate, and develop DHS-CS employees to reinforce the values of expertise, innovation, and adaptability.”

DHS was granted the authority to create a new personnel system for cybersecurity in 2014. What came out of that was the Cyber Talent Management System, an “agile and innovative personnel system” that better equips DHS to “compete for cyber talent with the private sector — speeding up the hiring process, attracting talent from non-traditional educational backgrounds, using innovative tools to assess applicants, and offering more flexible performance-based compensation.”

When finalized, the rule will allow DHS to hire cybersecurity personnel at salaries based on their skills, up to $255,800 —the vice president’s salary. That, however, can be overridden in special circumstances, with an “upper limit of 150 percent of EX-I ($332,100 in 2021),” the rule says.

“To invoke the extended range for specific DHS-CS employees, the Secretary must determine based on the CTMS compensation strategy, that the employee’s qualifications, the employee’s mission impact, and mission-related requirements warrant adjusting the employee’s salary beyond the standard range,” says the rule.

On a new recruitment webpage, DHS also touts the Cybersecurity Service’s career development approach. “DHS Cybersecurity Service employees are encouraged to keep their skills sharp and remain aware of emerging technology and threats through regular training opportunities,” it says, adding that employees will “participate in a range of classroom and on-the-job learning activities based on their current responsibilities, skills, interests, and career goals.”

DHS received $62 million between fiscal 2014 and 2021 to design and build the Cyber Talent Management System and Cybersecurity Service. For fiscal 2022, it has requested $16 million to finally launch and administer the programs. The department also hopes to hire 150 cyber professionals using the system.

The interim final rule officially takes effect Nov. 15 and is open for public comment until Dec. 31.

Other organizations including the Partnership for Public Service are working on improving the pipeline of cybersecurity talent into federal government. Earlier this week the nonprofit announced the second cohort of participants in its cybersecurity talent initiative, which aims to improve knowledge sharing between the private and public sector.

Note: This article was updated to include details of the Partnership for Public Service’s cybersecurity talent initiative.