Three principles to ensure a secure remote workforce

In many ways, 2020 served as an unintentional proof of concept for many organizations that workers can be just as productive at home as inside the office, according to a recent Okta report.

As agency leaders begin to look at a more permanent remote or hybrid-work future for some of their employees, they also need to consider both infrastructure and security modernization they will need to support the mission.

“Agencies will need to modernize access…but also security, because attackers never standstill,” says Sean Frazier, federal CSO at Okta in the report.

The report, “The 3 Tenets of Enabling a Remote Government Workforce,” produced by Okta, outlines strategies for agency leaders to consider that will support a more permanent remote workforce built on the principals of zero trust.

As agencies continue down the road to modernizations, says Frazier in the report, they need to change both their infrastructure and their mindset to evolve with changing workforce needs. That includes modernizing the identity stack, focusing on usability and putting security first.

Learn more about how ICAM platforms help agencies stay secure and productive in the age of telework.

This article was produced by FedScoop for, and sponsored by, Okta.

Observability: Modern tools for modern challenges in multi-cloud environments

While federal agencies are making significant headway moving IT workloads to multiple cloud service platforms, they continue to face a variety of challenges in gaining a complete picture of their total operating environment. A new generation of automated solutions — designed to provide end-to-end observability of assets, applications and performance across legacy and cloud systems — make that job easier, says Federal Chief Technology Officer Willie Hicks at Dynatrace. 

Hicks, who led IT operations in the financial sector for nearly two decades before joining Dynatrace, describes in this exclusive FedScoop interview how automated software intelligence platforms — and “deterministic AI” — can give agencies a faster and more powerful way to optimize application performance and security in dynamic IT environments. 

FedScoop: What are you seeing as the key pain points federal IT leaders are wrestling with now to manage operations in today’s increasingly dynamic and distributed IT environments?

Willie Hicks: Oftentimes, they don’t know what they don’t know. They don’t have visibility or “observability” into their systems. Observability means taking application performance management (APM) to the next level. With traditional APM you gathered metrics, logs, or even some transactional data. Five or six years ago, that manual approach may have been okay because you were often dealing with one runtime, like Java.

In today’s landscape, applications are being built cloud native, taking advantage of microservices, distributed across multiple clouds, often utilizing multiple run times. Instrumenting and collecting data using the old approach is not sustainable for this new environment, and the data fidelity of older APM technologies is not fine enough to adequately monitor and analyze these highly complex systems. Instead, an observability platform can automate the capture of high fidelity data, analyze it, and make sense of systems that are now too complex for a single person or even a team of people to analyze and find root causes when problems occur.  

Many of our government customers have these extremely complex systems — legacy data centers or hybrid environments — where they are crossing multiple clouds, and they start to lose control and visibility into these apps. And that leads to a lack of understanding when there is a problem: Where is the problem originating? What’s the root cause? And how do I quickly resolve it? But these systems must always be on and highly available. Think of the military with critical weapon systems. If these systems aren’t online or performing at full capacity, it could compromise our national security. The same is true for so many other agencies. Observability provides full situational awareness of all of your assets at any given time and an understanding of how they’re performing. And when they’re not, what is the root cause? 

FedScoop: There are a lot of solutions that claim to provide a single-pane-of-glass view of agency networks and applications. What is keeping agencies from adopting these more comprehensive solutions to capture system-wide visibility?

Hicks: Unfortunately, this type of visibility is oftentimes an afterthought. When these systems are designed and built, there’s often a lack of knowledge about platforms like Dynatrace that can provide this type of visibility. A lot of agencies still think in terms of needing to scrub every log to correlate events so they can figure out what’s causing a problem. That’s an antiquated approach. 

What they’re missing is true causal analysis. And to get to that point, you have to have a platform that’s going to be easy to deploy. It has to be automated. And it has to start sending those key telemetry points and do the analysis automatically. 

FedScoop: How mature are the AI and automation capabilities in these types of platforms, and can they really accommodate the mix of legacy and cloud systems agencies have to manage?

Hicks: Everyone’s talking about AI Ops and machine learning. There is a lot of confusion about what AI really can do today and what AI is really good at. Let me be clear. AI is extremely important. In most large organizations in the private sector, but especially in the public sector, you’re looking at these massive systems that have billions of dependencies that could go wrong. You couldn’t analyze all of those without AI.

At Dynatrace, we use more of a deterministic kind of AI model, which is actually quicker in addressing these types of problems. Systems are very dynamic. You have lots of containers spinning up and down. You’re bringing more servers online in the cloud. AI that uses machine learning requires a slower process in order to train their algorithms. It would be tripped up by a lot of dynamic changes in the system. Deterministic AI can handle that type of dynamic environment and give you good answers, even though this system might be shifting and changing under it. 

Another key problem when we start talking about AI and AI Ops…is explain-ability. We have to build into the system the ability to provide an explainable view of what’s happening for the customer and to program owners — that not only tells me what the problem is but shows me why it is the problem. And why you implemented whatever fix you deployed. 

Finally, agencies need to ask are we going to build our own AI monitoring system? Are we going to partner with industry and get something off the shelf? Or work with a contractor to build an AI system to identify problems on our network? Dynatrace partners with agencies to deploy better observability into their most critical systems that have gotten too complex — or in instances where they don’t have visibility out to the edge anymore, like they did when they controlled everything in their data center. Agencies need something that can parse billions of dependencies; something that can scale to handle tens of thousands of devices; something that can easily perform root cause analysis. I see RFPs almost every week from CIOs and agencies that are looking for these types of monitoring systems now. 

FedScoop: What does observability mean in all of this?

Observability extends beyond the analysis of metrics, logs, and traces to also integrate user experience data, as well as data from the latest open source standards (e.g. OpenTelemetry), all in context, at massive scale and with very low overhead.  

It’s important to note that observability is not just a beefed-up term for monitoring. Monitoring is something you do; observability is something you have. Typically, monitoring requires insight into exactly what data to monitor. It’s great for tasks like tracking performance, identifying problems and anomalies, finding the root causes of issues, and gaining insights into physical and cloud environments. If or when something goes wrong, a good monitoring tool alerts you to what is happening based on what you’re monitoring. 

You need monitoring to have observability. Monitoring can view the external, and logging can see the outputs over time. With these combined, observability can be achieved by inferring the internal based on the historical. Think of observability as that insight you need to have on exactly what to monitor. It’s proactive, using logs, AI, and causation to create a holistic system that is visible for everyone. 

FedScoop: What do you say to agencies to give them greater assurance that these automation and intelligent tools can and will perform reliably?

Hicks: Before I joined Dynatrace, I worked for some large banks for about 17 years. And I’ve been in the application performance space for quite some time. I lived through trying to configure systems to generate reports and trying to isolate root cause. Oftentimes, the purpose-built software we bought for monitoring became shelf ware because it was simply too difficult to deploy, too difficult to configure, too difficult to understand. And that was well before AWS, Azure and cloud. The level of complexity has grown an order of magnitude. Now there are systems with hundreds of different physical systems, containers, cloud instances, databases, and back end supporting systems running in the cloud. How do you instrument all that when you don’t even know what’s there?

I guarantee you, if I went to five different people in the organization — a developer, a system admin, a network person, the business owner, the application owner — and said “Show me a simple diagram of the application,” every one of them would give me a different diagram, if they could do it at all. No one knows how the whole system was created. No one knows what is there at any given time. 

You need to have an automated platform to keep track of the true breadth of details, or you will not get complete observability. It has to be intelligent, because there can be millions, if not billions of dependencies, making it virtually impossible to understand manually. So this idea of intelligent, automated observability is a necessity; you really can’t do it any other way.

Learn more about how Dynatrace can help your organization transform faster through advanced observability, automation and intelligence in one platform.

Department of Transportation fills CIO vacancy

The Department of Transportation has hired Cordell Schachter to be CIO.

Schachter joined the department Aug. 30, a DOT official told FedScoop. He replaces Deputy CIO Jack Albright who had been serving in the role in an acting capacity since former CIO Ryan Cote stepped away from the role in January during the transition to the Biden administration.

“As U.S. DOT Chief Information Officer, I look forward to supporting the work of Secretary Pete Buttigieg, Deputy Secretary Polly Trottenberg, and the entire Biden-Harris administration to Build Back Better to provide greater equity when improving the nation’s infrastructure,” Schachter said in a statement to FedScoop.

As the former longtime CTO of the New York City Department of Transportation, Schachter comes to the role with a wealth of experience. In that role, Schachter said he helped lead NYC’s DOT when responding to crises such as restoration after Superstorm Sandy in 2012 and the recent transition to telework during COVID-19.

Prior to his 13-year run with NYC’s DOT, he also worked for NYC’s Department of IT and in a variety of private-sector IT management positions with Avaya, IBM and AT&T. He also spent more than a decade early in his career with the city’s Department of Parks and Recreation.

Schachter is also an adjunct professor in NYU’s Center for Urban Science and Progress and Wagner School of Public Service.

Navy to stand up new AI and unmanned system task force

The Navy’s 5th Fleet in Central Command is establishing a new task force focused on integrating artificial intelligence with new unmanned systems, officials told reporters Wednesday.

Task Force 59, which will officially launch Sept. 9, will pull technical experts along with outside advisors from offices like the Joint AI Center to test new AI and unmanned tech. The work will focus on integrating new AI tech into unmanned systems across domains, not just the aerial systems currently in development.

“Think of it as going on offensive with unmanned,” Vice Adm. Brad Cooper, commander U.S. Naval Forces Central Command, said.

The task force will focus on testing new tech and integrating systems, and is intended to play a key role in the International Maritime Exercise (IMX) scheduled for early 2022. IMX is a military exercise that has regularly taken place since 2012, which the Naval Forces Central Command conducts alongside other nations.

The Navy has several offices working on unmanned vessels that have launched successful tests, and in March unveiled a new unmanned campaign.

Its strategy focuses on enabling maritime operations with manned and unmanned systems working along side each other. The plan received mixed reactions in Congress, which ultimately will need to fund the unmanned platforms the Navy plans to request.

One of the integration problems the task force will look at is building trust between operators and machines.

“It is really about building trust between the human and the machine,” Captain Michael Brasseur, the commodore for Task Force 59, said on the call with reporters.

Task Force 59 will be stood up in Central Command as it’s very “maritime centric,” Cooper said. The area also present a range a challenges to test tech against, including rough seas, hostile adversaries and unpredictable weather.

“The concept here is if you can operate here you can probably operate in other areas,” Cooper added.

Commerce establishes National AI Advisory Committee

The Department of Commerce has set up a committee to advise the president and other federal agencies on artificial intelligence issues, Secretary Gina Raimondo announced Wednesday.

It seeks to recruit top-level talent to serve on the new panel, which is called the National AI Advisory Committee. DOC also seeks members for a new AI and Law Enforcement subcommittee.

DOC and the National AI Initiative Office formed the committee, in accordance with the National AI Initiative Act of 2020. It will issue recommendations on U.S. AI competitiveness, workforce equity, funding, research and development, international cooperation, and legal issues.

“We have seen major advances in the design, development and use of AI, especially in the past several years,” said Eric Lander, director of the White House Office of Science and Technology Policy, in a statement. “We must be sure that these advances are matched by similar progress in ensuring that AI is trustworthy and that it ensures fairness and protections for civil rights.”

NAIAC will consist of members from academia, industry, nonprofits and federal laboratories.

Meanwhile the National Institute of Standards and Technology continues to develop guidance on trustworthy, explainable AI and will offer administrative support to the committee.

Nominations for NAIAC and its subcommittee nominations will occur on a rolling basis, with new members to be considered as vacancies arise.

State Department made little progress on online passport renewal the last decade

The State Department made “virtually no progress” on two passport systems projects, one of which would allow people to renew passports online, over the last decade, according to an Office of Inspector General report released Tuesday.

OIG found that, within the Bureau of Consular Affairs, the Passport Services Directorate (CA/PPT) relies too heavily on the Office of Consular Systems and Technology (CA/CST) to manage its IT modernization initiatives.

That over-reliance delayed both the Online Passport Renewal and Next Generation Passport systems, which are part of the ConsularOne program started in 2009 and that spent $59 million on passport projects as of December 2020.

“Had the Online Passport Renewal system been available, CA/PPT could have pivoted to remote work and kept a greater portion of the incoming passport applications moving throughout the COVID-19 pandemic-related maximum telework orders in 2020,” reads the report. “However, since the system was unavailable, CA/PPT staff were required to return to the office sooner than other department employees to address the backlog of passport applications that accumulated during the pandemic’s first few months.”

Only 13,002 passports were issued in May 2020, compared to 1.8 million in May 2019, and revenue consequently dropped from $852 million to $646 million.

System objectives for both systems in the fiscal 2020-2022 Passport Services’ Strategic Plan were “essentially unchanged” from plans dating back to fiscal 2010, according to the report.

OIG found CA/CST has yet to establish a “sufficient” test environment that supports multiple scenarios for the Online Passport Renewal system. The office began with an agile development approach before reverting to a phased, sequential process.

As for the Next Generation Passport system, CA/CST struggled to develop software that could interface with new passport printers for printing more secure passports — delaying a pilot until March 2021.

While CA/CST was not part of OIG’s investigation, an investigation of the ConsularOne program was subsequently launched in the spring.

For its part, CA/PPT lacked project management processes like a collaborative performance evaluation plan, communication plan and risk management strategy. The directorate’s staff was also unfamiliar with project communication plans and didn’t document points of contact for each project, according to the report.

CA/PPT and CA/CST further failed to coordinate on interdependent project tasks and communication and planning. CA/CST couldn’t provide CA/PPT with project timelines.

As a result, OIG recommended CA implement department project management processes.

CA/PPT’s SharePoint site contained broken hyperlinks and performance award information that hadn’t been updated since 2015. And its FAQ forum, PPT Answers, hadn’t operated since 2018, so OIG recommended CA ensure content was regularly refreshed.

Lastly OIG recommended CA implement a storage process for archived advisory opinions on citizenship and passport adjudication issues, so they’d be searchable and readily retrievable.

CA concurred with all three recommendations in its July 29 response.

How federal agencies are shifting IT investment strategies

When it comes to mission critical operations and the IT that supports them, federal government IT officials and influencers see a compelling return on investment for a hybrid IT model, according to a new FedScoop research study.

According to respondents in the survey, 75% agree that establishing a hybrid IT environment — both on-prem and in the cloud — offers the best ROI over the next three to five years. 

The survey, “The Hybrid Cloud Debate,” produced by FedScoop and underwritten by Hewlett Packard Enterprise, asked 212 IT decision makers from federal civilian, defense and intelligence agencies — plus system integrators — about their post-pandemic IT strategies and priorities. 

Among the findings, 76% of respondents agree that modernizing or upgrading their existing data center operations offers the best ROI over the next three to five years. But nearly as many also agree that moving existing data center operations to a federally-authorized cloud (68%), or to a dedicated private cloud platform (64%) — also offer strong returns on IT investments over that time frame as well.

While agencies differ on what mix of cloud and on-prem structure works best, respondents indicate their agencies are committed to a hybrid model. Looking ahead two years from now, fully 41% of respondents — a reduction from 50% currently — expect their agencies will devote 70% or more of IT spending to on-prem infrastructure, applications and IT services. 

“When considering aspects of on-prem versus cloud, how the data is secure in transit and at rest always needs to be the leading decision factor,” shared Scott Cassady, sales director for U.S. public sector PointNext Services at Hewlett Packard Enterprise, after an initial review of the report’s findings. 

The study examines the biggest motivators and challenges that small, medium and large agencies face in pursuing pay-on-demand, or IT-as-a-service solutions in managing their IT operations. IT gauges current perceptions about the costs of moving data in and out of cloud platforms and whether agencies believe they have the requisite skills to develop and maintain a hybrid cloud environment.

Fortunately for federal agencies, a shortage of in-house IT skills agencies familiar with how to build and operate a hybrid cloud environment appears not to be as dire a concern as it once was.

“Today, agencies can leverage cloud — either on- or off-premises — where refactoring and recoding is never a requirement to be operational,” said Cassady.

The study concludes with suggestions on what agencies should consider as they continue to build out their hybrid IT environments.

Download the report, “The Hybrid Cloud Debate” to read more about what agency leaders are considering as they create their hybrid IT strategies.

This article was produced by FedScoop and sponsored by Hewlett Packard Enterprise.

GSA names Raylene Yung director of Tech Modernization Fund

The General Services Administration has appointed Raylene Yung as executive director of the Technology Modernization Fund.

She joins the organization after stepping down as CEO of the nonprofit U.S. Digital Response, which she helped to found in March 2020.

Yung will oversee the Technology Modernization Fund Program Management Office, which was authorized by the Modernizing Government Technology Act of 2017, and will be tasked with giving agencies additional ways to deliver services to the American public more quickly and efficiently.

She has over 10 years of experience in technology across the private sector, government and nonprofit organizations. Previously she was a member of the Biden-Harris transition team identifying key policy priorities for the administration with a critical technical focus.

GSA Administrator Robin Carnahan said in a statement on Yung’s appointment: “The future of government services is digital.”

“Modernizing technology means delivering a better experience for the public, securing our nation’s infrastructure, creating shared services that save taxpayers money and addressing the critical challenges of climate change and the ongoing COVID-19 pandemic,” Carnahan said. “Raylene brings a wealth of experience in technology policy and the private sector that will help us more effectively rethink the way we invest in modernizing our nation’s digital infrastructure. We look forward to having her on the team.”

Yung’s appointment comes as the TMF has received a $1 billion injection of capital from the American Rescue Plan Act and the team behind it must now work to deliver funding to agencies at a scale unprecedented for the fund.

According to Federal CIO Clare Martorana, the Technology Modernization Board has received over 100 proposals for projects, totaling more than $2 billion, since funding was appropriated in March through the American Rescue Plan.

Late last week, the House Committee on Oversight and Reform voted to adopt an amendment as part of the fiscal 2022 budget reconciliation process that could provide an extra $3 billion for federal IT modernization, including $1 billion for the Technology Modernization Fund.

Air Force awards potential $46B digital engineering contract vehicle

The Air Force awarded a major digital engineering contract to 55 companies that aims to increase the service’s ability to work on digital designs of its future platforms.

The $46 billion indefinite-delivery, indefinite-quantity initially only obligated $55,000 in research and development funds for fiscal 2020 and 2021 at the time of award, according to a Department of Defense press release. Air Force Officials have previously stated high interest in developing the ability to digitally design and test hardware like airplanes before they go into production, a capability served by digital engineer.

The procurement is for digital engineering and model-based systems engineering. Contractors will also provide services to support agile processes, open systems architecture and weapons and enterprise analytics.

By building virtual environments that simulate the physical conditions a weapon system or airplane will sustain during use, the Air Force could optimize designs before they are physically created and tested in the real world. The prospective tech that could save the department both time and money, officials have said.

The service has been working to advance digital engineering practices internally and with contractors. Former head of acquisition, technology and logistics, Will Roper, pitched companies on using the Air Force’s own tech stack to mixed reactions.

Companies selected for potential future task orders include both major defense contractors such as Booz Allen Hamilton and Lockheed Martin, and smaller startups like Shield AI.

OMB publishes zero-trust draft strategy

The Office of Management and Budget published a draft strategy Tuesday that will clarify key zero-trust priorities for civilian agencies as they roll out the cybersecurity architecture over the next few years.

Alongside the proposals issued, the Cyber and Infrastructure Security Agency also released a new cloud security technical reference architecture (TRA) and zero-trust maturity model to guide implementation.

Both agencies are seeking public feedback on the draft documents, which they hope will further strengthen the plans.

Top priorities identified in OMB’s new strategy include consolidating agency identity systems, combatting phishing through strong multifactor authentication and treating internal networks as untrusted. It also spells out the need to encrypt traffic and strengthen application security.

The new federal zero-trust strategy is intended to focus government departments on key security outcomes and to set baseline policy and technology requirements. It supports the executive order on cybersecurity issued by President Biden in May, which reignited the push to zero trust.

OMB and CISA publish the documents as part of a long-running campaign to push federal agencies to adopt zero-trust architecture — a strategic initiative that helps prevent successful data breaches by eliminating the concept of trust from an organization’s network architecture.

“Moving to zero-trust architectures will by a multi-year journey for federal agencies, and the government will learn and adjust along the way as new practices and technologies emerge,” OMB said.

CISA’s new cloud security technical reference architecture and zero-trust maturity model were developed as part of a multi-agency effort with contributions from the U.S. Digital Service and the Federal Risk and Authorization Management Program (FedRAMP). The technical reference architecture and zero-trust maturity model are intended to provide agencies with guidance on a range of cloud security-related issues.

“With today’s zero trust announcement, we are clearly driving home the message to federal agencies that they should not automatically trust anything inside or outside of their perimeters,” Federal CIO Clare Martorana said in a release. “They must verify anything and everything trying to connect to their systems before granting access. This is an expectation in a modern technology environment and we look forward to this public comment process to make our strategy even stronger.”

Federal CISO Chris DeRusha said: “The federal government’s approach to cybersecurity must rapidly evolve to keep pace with our adversaries, and moving toward zero trust principles is the road we need to travel to get there … While we feel the urgency to begin implementing this plan, we know that input from the broader community of experts will help ensure it is the right plan. We welcome feedback on how we can refine this strategy to best advance federal cybersecurity.”