Imposter email attacks: Overcoming ‘needle-in-a-haystack’ threats

Rob Holmes is vice president of products at Proofpoint. He has over 15 years’ experience in brand and fraud protection, and currently drives strategy for email fraud defense.

Email-based attacks represent a serious needle-in-a-haystack threat for organizations. To paint a picture of how serious, consider that in a typical seven-day period in mid-February 2021, Proofpoint found that 98% of 3,000 monitored organizations received a threat from a supplier domain.

Imposter email threats and business email compromise (BEC) — where cyber criminals pose as someone the recipient should trust — can increasingly evade traditional security solutions that look for malicious content or behavior because those emails don’t use malicious attachments or URLs. Instead, they use social engineering to trick individuals into transferring money or sharing valuable access information unwittingly with hackers.

The scope of these attacks, however, represents a growing risk for government organizations. While imposter emails and BEC used to primarily hijack the identities of executives and organizations’ leaders, threat actors are shifting their focus to a more potentially lucrative opportunity — impersonating or compromising an organization’s suppliers.

Within most organizations there are only a relative handful of senior executives who have significant budgetary discretion, but a federal government agency may have thousands of suppliers to which significant payments are already being made. The size and nature of the supply chain attack surface therefore make it the perfect vehicle for email fraud: by hijacking any one of those suppliers’ trusted identities, a threat actor may be able to socially engineer someone in an accounts payable team to update the supplier’s banking details and redirect payments. 

To launch an imposter email or BEC attack, threat actors employ a range of tactics, the most valuable of which is a compromised account at a supplier. Not only does the compromise afford the threat actor unrestricted access to conduct research and construct an appropriate lure or insert themselves opportunistically into email conversations, but also any emails sent from that compromised account will pass all forms of email authentication. 

However, to maintain persistence and avoid detection, threat actors will often then redirect the conversation to a lookalike email account that they own and control. That may be at a lookalike domain or webmail account they had previously registered. Furthermore, most suppliers’ domains are still vulnerable to spoofing, which enables threat actors to abuse the trust and reputation of a supplier to deliver a highly credible lure.

Combatting these tactics requires a different cybersecurity approach that dynamically analyzes the attributes of an email as it arrives and detects anomalies that point to an imposter.

Establishing a multi-layered security defense

Establishing trust in identity is crucial to detecting cyberthreats, which is why the recent White House Executive Order on zero trust explicitly requires that all agencies deploy multi-factor authentication within the year. 

But to effectively combat email-based attacks, like imposter emails, agencies need to establish a multi-layered defense against infiltration that include requiring stronger identity controls of their suppliers as well.

For example, federal directives already require civilian agencies to configure their domains with domain-based message authentication reporting and conformance (DMARC) records. DMARC can provide a highly effective way to protect organizations against phishing and other fraudulent activity that spoof domains that should otherwise be trusted. 

For email sent to an agency’s supplier, modern DMARC solutions ensure that legitimate email gets properly authenticated and that fraudulent activity, appearing to come from domains under an agency’s control for instance, are blocked before it reaches that supplier. 

Proofpoint’s DMARC solution allows agencies to take this security capability a step further. Once an agency can establish with certainty that it can account for all its legitimate suppliers, the solution allows an agency to establish a policy for incoming emails from these suppliers, blocking any emails that don’t come from an approved IP address or bear the right cryptographic signature. 

In addition to modern MFA and DMARC solutions, agencies also need to rely on intermediaries between users and cloud service providers. Cloud access security brokers (CASB), for instance, identify anomalous behavior on secure cloud applications and intercept fictitious activity.

Tapping into a larger network to improve visibility

According to Proofpoint’s security data, current attack patterns indicate that threat actors are increasingly using a combination of phishing strategies and credential dumps from prior attacks to breach agency networks and their suppliers. If agencies and their suppliers only focus on their own IT environments, they may not see any immediate threats that are growing within their supply chain.

That is why we recommend using an integrated security platform that offers a number of capabilities to combat cyberthreats. 

At Proofpoint, we bring to bear the power of working with a global network of customers, assessing more than 2.2 billion emails per day and more than 35 million cloud accounts to identify and block advanced threats and look for compliance risks. We see how organizations are getting attacked and which countermeasures are proving most effective.

Even if your agency’s security team doesn’t directly identify threats coming from a compromised supplier, with our 8,000 enterprise and federal gateways in place, we can tell our customers if other companies in their federal space have been targeted. 

That gives agencies a better chance to extend the visibility of their cyber risk to get ahead of, or predict, future threats. 

Learn more about how Proofpoint can help protect federal agencies, and their people, against malicious attackers. 

Federal zero-trust strategy needs more deadlines say tech officials

The Office of Management and Budget’s draft federal zero-trust strategy needs more deadlines on required actions to help agencies prioritize them, according to tech officials.

Deadlines give chief information security officers (CISOs) something to point to during discussions with agency leadership over which zero-trust security goals to fund during the budgeting process.

Currently the draft strategy simply requires agencies to complete its identity, device, network, application and data actions by the end of fiscal 2024 — a broad deadline that doesn’t offer guidance on how to prioritize them individually.

“There’s a lot of value in a strategy document, and I’m a big fan,” said Shane Barney, CISO at U.S. Citizenship and Immigration Services, during an AFCEA Bethesda webinar Wednesday. “But there’s also a lot of value in adding teeth.”

Agencies can’t drum up the resources for a zero-trust security architecture overnight, said Sheena Burrell, deputy chief information officer at the National Archives and Records Administration. Planning and alternative funding sources, like the Technology Modernization Fund, are needed.

NARA intends to use TMF funds to build out its zero-trust architecture in accordance with the recent cybersecurity executive order and subsequent OMB guidance.

“My agency is putting in for some of our cybersecurity issues looking at our high-value assets, trying to modernize those systems, as well as looking at our zero-trust architecture and these other key pieces and putting in a request for that Technology Modernization Fund because we didn’t have that money,” Burrell said. “And we didn’t have those resources when [this guidance] came out.”

That the strategy states the goal of a zero-trust model is to place the entire enterprise on the public internet is “revolutionary” and will help agencies design their architectures and define trust, Barney said. And he’s a “big fan” of the requirement that agencies develop a network segmentation plan in consultation with the Cybersecurity and Infrastructure Security Agency to submit to OMB.

Barney would like to see a “no humans in production” requirement — where products are automatically deployed to a production environment without manual intervention — however. USCIS isn’t 100% of the way there yet.

“Humans in production should be a break-glass event; in other words it should be something that’s an emergency,” Barney said. “You moving product into production should be an automated pipeline.”

The strategy should also add an extra layer of security for token-based authentication, so it’s not just multi-factor but multi-tiered. Think adding YubiKey infrastructure — that’s separate from the regular, challenge-handshake authentication protocol — for high-level access accounts.

“Because one of the things you saw with SolarWinds was the ability for threat actors to use or compromise some of our core security in terms of identity,” Barney said.

Barney also took issue with the strategy’s requirement that CISA adapt the Continuous Diagnostics and Mitigation program to avoid the use of privileged software agents wherever possible. The problem there is a number of security tools like Splunk require privileged accounts to run, so the strategy should be clarified to explain what mitigation, monitoring and risk-based scenarios are needed, he said.

Eight bid protests over CIO-SP4 solicitation yet to be resolved

Eight bid protests filed with the Government Accountability Office over the National Institutes of Health’s $50 billion CIO-SP4 healthcare IT contract vehicle have yet to be resolved.

According to sources, the complaints focus largely on a points-based evaluation system used to assess contractors bidding on the contract as part of a mentor-protégé system run by the Small Business Administration (SBA) that may make it hard for some smaller contractors to earn a spot on the vehicle.

A total of 21 protests have so far been filed over CIO-SP4 since a request for proposals was issued in May this year. Of complaints submitted, three have been withdrawn and 10 have been dismissed.

CIO-SP4 is one of the largest technology procurement vehicles to be launched in recent years and has 10 task areas, including IT services, CIO support, cybersecurity, digital government and cloud services, and software development.

Amendments made to the solicitation since May have come under scrutiny because of concerns that changes to the contract’s points-based evaluation system may preclude some smaller companies from using the track record of mentor companies to prove their eligibility for consideration as vendors.

The SBA’s mentor-protégé program is designed to foster small business innovation by allowing larger companies to vouch for emerging businesses as part of a joint venture arrangement.

According to federal government estimates, the contract should be awarded by February 2022. Federal contracting sources queried the timeline and said that such processes typically take as long as one year to complete.

Since the start of the solicitation process in May, the National Institutes of Health Information Technology Acquisition and Assessment Center (NITAAC) has issued 11 amendments to the procurement contract, which sources described as unprecedented.

“I have worked on these types of federal contracts for 15 years, and I have never seen anything like this,” said one source.

Some amendments issued by NITAAC posed a major challenge for contractors by bringing into question the ability of smaller companies bidding on CIO-SP4 to use teaming agreements.

As part of the bid protest process, contractors can take allegations to the GAO, which will assess the merits of their case and issue a binding decision. Bid protests must be resolved within 100 days of being filed.

Earlier in July, the Professional Services Council urged the National Institutes of Health to explain its treatment of tech industry questions about the request for proposals issued for the $50 billion CIO-SP4 contract.

The contract solicitation was launched in May after a year-long draft solicitation process.

The Department of Health and Human Services did not respond to a request for comment.

Three principles to ensure a secure remote workforce

In many ways, 2020 served as an unintentional proof of concept for many organizations that workers can be just as productive at home as inside the office, according to a recent Okta report.

As agency leaders begin to look at a more permanent remote or hybrid-work future for some of their employees, they also need to consider both infrastructure and security modernization they will need to support the mission.

“Agencies will need to modernize access…but also security, because attackers never standstill,” says Sean Frazier, federal CSO at Okta in the report.

The report, “The 3 Tenets of Enabling a Remote Government Workforce,” produced by Okta, outlines strategies for agency leaders to consider that will support a more permanent remote workforce built on the principals of zero trust.

As agencies continue down the road to modernizations, says Frazier in the report, they need to change both their infrastructure and their mindset to evolve with changing workforce needs. That includes modernizing the identity stack, focusing on usability and putting security first.

Learn more about how ICAM platforms help agencies stay secure and productive in the age of telework.

This article was produced by FedScoop for, and sponsored by, Okta.

Observability: Modern tools for modern challenges in multi-cloud environments

While federal agencies are making significant headway moving IT workloads to multiple cloud service platforms, they continue to face a variety of challenges in gaining a complete picture of their total operating environment. A new generation of automated solutions — designed to provide end-to-end observability of assets, applications and performance across legacy and cloud systems — make that job easier, says Federal Chief Technology Officer Willie Hicks at Dynatrace. 

Hicks, who led IT operations in the financial sector for nearly two decades before joining Dynatrace, describes in this exclusive FedScoop interview how automated software intelligence platforms — and “deterministic AI” — can give agencies a faster and more powerful way to optimize application performance and security in dynamic IT environments. 

FedScoop: What are you seeing as the key pain points federal IT leaders are wrestling with now to manage operations in today’s increasingly dynamic and distributed IT environments?

Willie Hicks: Oftentimes, they don’t know what they don’t know. They don’t have visibility or “observability” into their systems. Observability means taking application performance management (APM) to the next level. With traditional APM you gathered metrics, logs, or even some transactional data. Five or six years ago, that manual approach may have been okay because you were often dealing with one runtime, like Java.

In today’s landscape, applications are being built cloud native, taking advantage of microservices, distributed across multiple clouds, often utilizing multiple run times. Instrumenting and collecting data using the old approach is not sustainable for this new environment, and the data fidelity of older APM technologies is not fine enough to adequately monitor and analyze these highly complex systems. Instead, an observability platform can automate the capture of high fidelity data, analyze it, and make sense of systems that are now too complex for a single person or even a team of people to analyze and find root causes when problems occur.  

Many of our government customers have these extremely complex systems — legacy data centers or hybrid environments — where they are crossing multiple clouds, and they start to lose control and visibility into these apps. And that leads to a lack of understanding when there is a problem: Where is the problem originating? What’s the root cause? And how do I quickly resolve it? But these systems must always be on and highly available. Think of the military with critical weapon systems. If these systems aren’t online or performing at full capacity, it could compromise our national security. The same is true for so many other agencies. Observability provides full situational awareness of all of your assets at any given time and an understanding of how they’re performing. And when they’re not, what is the root cause? 

FedScoop: There are a lot of solutions that claim to provide a single-pane-of-glass view of agency networks and applications. What is keeping agencies from adopting these more comprehensive solutions to capture system-wide visibility?

Hicks: Unfortunately, this type of visibility is oftentimes an afterthought. When these systems are designed and built, there’s often a lack of knowledge about platforms like Dynatrace that can provide this type of visibility. A lot of agencies still think in terms of needing to scrub every log to correlate events so they can figure out what’s causing a problem. That’s an antiquated approach. 

What they’re missing is true causal analysis. And to get to that point, you have to have a platform that’s going to be easy to deploy. It has to be automated. And it has to start sending those key telemetry points and do the analysis automatically. 

FedScoop: How mature are the AI and automation capabilities in these types of platforms, and can they really accommodate the mix of legacy and cloud systems agencies have to manage?

Hicks: Everyone’s talking about AI Ops and machine learning. There is a lot of confusion about what AI really can do today and what AI is really good at. Let me be clear. AI is extremely important. In most large organizations in the private sector, but especially in the public sector, you’re looking at these massive systems that have billions of dependencies that could go wrong. You couldn’t analyze all of those without AI.

At Dynatrace, we use more of a deterministic kind of AI model, which is actually quicker in addressing these types of problems. Systems are very dynamic. You have lots of containers spinning up and down. You’re bringing more servers online in the cloud. AI that uses machine learning requires a slower process in order to train their algorithms. It would be tripped up by a lot of dynamic changes in the system. Deterministic AI can handle that type of dynamic environment and give you good answers, even though this system might be shifting and changing under it. 

Another key problem when we start talking about AI and AI Ops…is explain-ability. We have to build into the system the ability to provide an explainable view of what’s happening for the customer and to program owners — that not only tells me what the problem is but shows me why it is the problem. And why you implemented whatever fix you deployed. 

Finally, agencies need to ask are we going to build our own AI monitoring system? Are we going to partner with industry and get something off the shelf? Or work with a contractor to build an AI system to identify problems on our network? Dynatrace partners with agencies to deploy better observability into their most critical systems that have gotten too complex — or in instances where they don’t have visibility out to the edge anymore, like they did when they controlled everything in their data center. Agencies need something that can parse billions of dependencies; something that can scale to handle tens of thousands of devices; something that can easily perform root cause analysis. I see RFPs almost every week from CIOs and agencies that are looking for these types of monitoring systems now. 

FedScoop: What does observability mean in all of this?

Observability extends beyond the analysis of metrics, logs, and traces to also integrate user experience data, as well as data from the latest open source standards (e.g. OpenTelemetry), all in context, at massive scale and with very low overhead.  

It’s important to note that observability is not just a beefed-up term for monitoring. Monitoring is something you do; observability is something you have. Typically, monitoring requires insight into exactly what data to monitor. It’s great for tasks like tracking performance, identifying problems and anomalies, finding the root causes of issues, and gaining insights into physical and cloud environments. If or when something goes wrong, a good monitoring tool alerts you to what is happening based on what you’re monitoring. 

You need monitoring to have observability. Monitoring can view the external, and logging can see the outputs over time. With these combined, observability can be achieved by inferring the internal based on the historical. Think of observability as that insight you need to have on exactly what to monitor. It’s proactive, using logs, AI, and causation to create a holistic system that is visible for everyone. 

FedScoop: What do you say to agencies to give them greater assurance that these automation and intelligent tools can and will perform reliably?

Hicks: Before I joined Dynatrace, I worked for some large banks for about 17 years. And I’ve been in the application performance space for quite some time. I lived through trying to configure systems to generate reports and trying to isolate root cause. Oftentimes, the purpose-built software we bought for monitoring became shelf ware because it was simply too difficult to deploy, too difficult to configure, too difficult to understand. And that was well before AWS, Azure and cloud. The level of complexity has grown an order of magnitude. Now there are systems with hundreds of different physical systems, containers, cloud instances, databases, and back end supporting systems running in the cloud. How do you instrument all that when you don’t even know what’s there?

I guarantee you, if I went to five different people in the organization — a developer, a system admin, a network person, the business owner, the application owner — and said “Show me a simple diagram of the application,” every one of them would give me a different diagram, if they could do it at all. No one knows how the whole system was created. No one knows what is there at any given time. 

You need to have an automated platform to keep track of the true breadth of details, or you will not get complete observability. It has to be intelligent, because there can be millions, if not billions of dependencies, making it virtually impossible to understand manually. So this idea of intelligent, automated observability is a necessity; you really can’t do it any other way.

Learn more about how Dynatrace can help your organization transform faster through advanced observability, automation and intelligence in one platform.

Department of Transportation fills CIO vacancy

The Department of Transportation has hired Cordell Schachter to be CIO.

Schachter joined the department Aug. 30, a DOT official told FedScoop. He replaces Deputy CIO Jack Albright who had been serving in the role in an acting capacity since former CIO Ryan Cote stepped away from the role in January during the transition to the Biden administration.

“As U.S. DOT Chief Information Officer, I look forward to supporting the work of Secretary Pete Buttigieg, Deputy Secretary Polly Trottenberg, and the entire Biden-Harris administration to Build Back Better to provide greater equity when improving the nation’s infrastructure,” Schachter said in a statement to FedScoop.

As the former longtime CTO of the New York City Department of Transportation, Schachter comes to the role with a wealth of experience. In that role, Schachter said he helped lead NYC’s DOT when responding to crises such as restoration after Superstorm Sandy in 2012 and the recent transition to telework during COVID-19.

Prior to his 13-year run with NYC’s DOT, he also worked for NYC’s Department of IT and in a variety of private-sector IT management positions with Avaya, IBM and AT&T. He also spent more than a decade early in his career with the city’s Department of Parks and Recreation.

Schachter is also an adjunct professor in NYU’s Center for Urban Science and Progress and Wagner School of Public Service.

Navy to stand up new AI and unmanned system task force

The Navy’s 5th Fleet in Central Command is establishing a new task force focused on integrating artificial intelligence with new unmanned systems, officials told reporters Wednesday.

Task Force 59, which will officially launch Sept. 9, will pull technical experts along with outside advisors from offices like the Joint AI Center to test new AI and unmanned tech. The work will focus on integrating new AI tech into unmanned systems across domains, not just the aerial systems currently in development.

“Think of it as going on offensive with unmanned,” Vice Adm. Brad Cooper, commander U.S. Naval Forces Central Command, said.

The task force will focus on testing new tech and integrating systems, and is intended to play a key role in the International Maritime Exercise (IMX) scheduled for early 2022. IMX is a military exercise that has regularly taken place since 2012, which the Naval Forces Central Command conducts alongside other nations.

The Navy has several offices working on unmanned vessels that have launched successful tests, and in March unveiled a new unmanned campaign.

Its strategy focuses on enabling maritime operations with manned and unmanned systems working along side each other. The plan received mixed reactions in Congress, which ultimately will need to fund the unmanned platforms the Navy plans to request.

One of the integration problems the task force will look at is building trust between operators and machines.

“It is really about building trust between the human and the machine,” Captain Michael Brasseur, the commodore for Task Force 59, said on the call with reporters.

Task Force 59 will be stood up in Central Command as it’s very “maritime centric,” Cooper said. The area also present a range a challenges to test tech against, including rough seas, hostile adversaries and unpredictable weather.

“The concept here is if you can operate here you can probably operate in other areas,” Cooper added.

Commerce establishes National AI Advisory Committee

The Department of Commerce has set up a committee to advise the president and other federal agencies on artificial intelligence issues, Secretary Gina Raimondo announced Wednesday.

It seeks to recruit top-level talent to serve on the new panel, which is called the National AI Advisory Committee. DOC also seeks members for a new AI and Law Enforcement subcommittee.

DOC and the National AI Initiative Office formed the committee, in accordance with the National AI Initiative Act of 2020. It will issue recommendations on U.S. AI competitiveness, workforce equity, funding, research and development, international cooperation, and legal issues.

“We have seen major advances in the design, development and use of AI, especially in the past several years,” said Eric Lander, director of the White House Office of Science and Technology Policy, in a statement. “We must be sure that these advances are matched by similar progress in ensuring that AI is trustworthy and that it ensures fairness and protections for civil rights.”

NAIAC will consist of members from academia, industry, nonprofits and federal laboratories.

Meanwhile the National Institute of Standards and Technology continues to develop guidance on trustworthy, explainable AI and will offer administrative support to the committee.

Nominations for NAIAC and its subcommittee nominations will occur on a rolling basis, with new members to be considered as vacancies arise.

State Department made little progress on online passport renewal the last decade

The State Department made “virtually no progress” on two passport systems projects, one of which would allow people to renew passports online, over the last decade, according to an Office of Inspector General report released Tuesday.

OIG found that, within the Bureau of Consular Affairs, the Passport Services Directorate (CA/PPT) relies too heavily on the Office of Consular Systems and Technology (CA/CST) to manage its IT modernization initiatives.

That over-reliance delayed both the Online Passport Renewal and Next Generation Passport systems, which are part of the ConsularOne program started in 2009 and that spent $59 million on passport projects as of December 2020.

“Had the Online Passport Renewal system been available, CA/PPT could have pivoted to remote work and kept a greater portion of the incoming passport applications moving throughout the COVID-19 pandemic-related maximum telework orders in 2020,” reads the report. “However, since the system was unavailable, CA/PPT staff were required to return to the office sooner than other department employees to address the backlog of passport applications that accumulated during the pandemic’s first few months.”

Only 13,002 passports were issued in May 2020, compared to 1.8 million in May 2019, and revenue consequently dropped from $852 million to $646 million.

System objectives for both systems in the fiscal 2020-2022 Passport Services’ Strategic Plan were “essentially unchanged” from plans dating back to fiscal 2010, according to the report.

OIG found CA/CST has yet to establish a “sufficient” test environment that supports multiple scenarios for the Online Passport Renewal system. The office began with an agile development approach before reverting to a phased, sequential process.

As for the Next Generation Passport system, CA/CST struggled to develop software that could interface with new passport printers for printing more secure passports — delaying a pilot until March 2021.

While CA/CST was not part of OIG’s investigation, an investigation of the ConsularOne program was subsequently launched in the spring.

For its part, CA/PPT lacked project management processes like a collaborative performance evaluation plan, communication plan and risk management strategy. The directorate’s staff was also unfamiliar with project communication plans and didn’t document points of contact for each project, according to the report.

CA/PPT and CA/CST further failed to coordinate on interdependent project tasks and communication and planning. CA/CST couldn’t provide CA/PPT with project timelines.

As a result, OIG recommended CA implement department project management processes.

CA/PPT’s SharePoint site contained broken hyperlinks and performance award information that hadn’t been updated since 2015. And its FAQ forum, PPT Answers, hadn’t operated since 2018, so OIG recommended CA ensure content was regularly refreshed.

Lastly OIG recommended CA implement a storage process for archived advisory opinions on citizenship and passport adjudication issues, so they’d be searchable and readily retrievable.

CA concurred with all three recommendations in its July 29 response.

How federal agencies are shifting IT investment strategies

When it comes to mission critical operations and the IT that supports them, federal government IT officials and influencers see a compelling return on investment for a hybrid IT model, according to a new FedScoop research study.

According to respondents in the survey, 75% agree that establishing a hybrid IT environment — both on-prem and in the cloud — offers the best ROI over the next three to five years. 

The survey, “The Hybrid Cloud Debate,” produced by FedScoop and underwritten by Hewlett Packard Enterprise, asked 212 IT decision makers from federal civilian, defense and intelligence agencies — plus system integrators — about their post-pandemic IT strategies and priorities. 

Among the findings, 76% of respondents agree that modernizing or upgrading their existing data center operations offers the best ROI over the next three to five years. But nearly as many also agree that moving existing data center operations to a federally-authorized cloud (68%), or to a dedicated private cloud platform (64%) — also offer strong returns on IT investments over that time frame as well.

While agencies differ on what mix of cloud and on-prem structure works best, respondents indicate their agencies are committed to a hybrid model. Looking ahead two years from now, fully 41% of respondents — a reduction from 50% currently — expect their agencies will devote 70% or more of IT spending to on-prem infrastructure, applications and IT services. 

“When considering aspects of on-prem versus cloud, how the data is secure in transit and at rest always needs to be the leading decision factor,” shared Scott Cassady, sales director for U.S. public sector PointNext Services at Hewlett Packard Enterprise, after an initial review of the report’s findings. 

The study examines the biggest motivators and challenges that small, medium and large agencies face in pursuing pay-on-demand, or IT-as-a-service solutions in managing their IT operations. IT gauges current perceptions about the costs of moving data in and out of cloud platforms and whether agencies believe they have the requisite skills to develop and maintain a hybrid cloud environment.

Fortunately for federal agencies, a shortage of in-house IT skills agencies familiar with how to build and operate a hybrid cloud environment appears not to be as dire a concern as it once was.

“Today, agencies can leverage cloud — either on- or off-premises — where refactoring and recoding is never a requirement to be operational,” said Cassady.

The study concludes with suggestions on what agencies should consider as they continue to build out their hybrid IT environments.

Download the report, “The Hybrid Cloud Debate” to read more about what agency leaders are considering as they create their hybrid IT strategies.

This article was produced by FedScoop and sponsored by Hewlett Packard Enterprise.