By Freddie Hudson Friday, Jan 20

As quantum computers continue to advance and become more powerful, they present a significant threat to the Department of Defense’s cybersecurity assurance.

When former Pentagon’s Chief Data Officer, David Spirk, left his post in March 2022, he did so with a warning: “I don’t think that there are enough senior leaders getting their heads around the [cybersecurity] implications of quantum… I think that’s a new wave of computers that, when it arrives, is going to be a pretty shocking moment to industry and government alike.”

Quantum computers have the ability to process information much faster than classical computers, making them capable of cracking the secure encryption algorithms relied on to protect information today. This could allow adversaries to access sensitive military intelligence, disrupt communication networks, and even disable military systems.

In late 2021, the head of the NSA’s Cybersecurity Directorate signaledthat developing next-generation cryptologic systems to secure weapon systems from foreign adversaries was a top priority. In a fact sheet published that year, the NSA stated that “the impact of adversarial use of a quantum computer could be devastating to National Security Systems.”

The battle for quantum supremacy is already under way, and is set to fundamentally change the defense sector as the technology edges towards maturation.

The quantum threat is closer than you think

Many experts, including Spirk, believe that military applications for quantum computing could be less than 10 years away.

Case in point: according to the Pentagon’s annual report on Chinese military power, China recently designed and fabricated a quantum computer capable of outperforming a classical high-performance computer for a specific problem.

This is also why DARPA announced the ‘Underexplored Systems for Utility-Scale Quantum Computing’ (US2QC) program to explore potentially overlooked methods by which quantum computers could achieve practical levels of utilization much faster than current predictions suggest.

The White House recently signed the Quantum Computing Cybersecurity Preparedness Act into law, signaling that it regards quantum as a serious issue. The act addresses the migration of executive agencies’ IT systems to post-quantum cryptography (PQC) – encryption which is secure from attacks by quantum computers because of the advanced mathematics underpinning it.

As major powers like China, under its Digital Silk Road initiative, continue to accelerate investment into advanced technologies like AI and quantum computing, the US risks being left behind if it does not pay equal attention to the quantum opportunity – and to the quantum threat.

The need for action is all the more urgent because of the looming threat of ‘harvest now, decrypt later’ attacks, by which adversaries can gather sensitive data today to decrypt as soon as they have their hands on a sufficiently powerful quantum computer.

Time is running out for the DoD

The defense sector needs to take the threat of quantum computers seriously because they have the potential to greatly impact national security.

Encryption is a crucial tool for protecting sensitive military information, and if quantum computers are able to break current encryption algorithms, this could compromise the security of classified documents, strategic plans, and even communication networks. This could potentially give adversaries an advantage in military conflicts and put US military personnel at risk.

In addition to the potential impact on national security, the defense sector also has a responsibility to protect the personal information of military personnel and civilians. Quantum computers could potentially be used to steal sensitive personal information, such as social security numbers, as well as medical and financial information.

As DoD moves from network-centric operations to data-centric operations, PQC implementation becomes even more relevant, regardless of whether the data comes from the cloud or any other source. DoD’s Joint All Domain Command and Control (JADC2) and Joint Cloud Computing concepts, network modernization etc. will all require post-quantum cryptography for cybersecurity assurance.

Quantum computers also have the ability to perform complex calculations at a much faster rate than classical computers, which could allow them to disable or manipulate military systems. This could potentially disrupt communication networks, navigation systems, and even weapons systems, leading to potential loss of lives and damage to military assets.

First-mover advantage

In July last year, the National Institute of Standards and Technology announced a major milestone in its efforts to standardize post-quantum cryptography algorithms.

New draft standards are a welcome arrival and will hopefully dispel any hesitation about putting concrete transition roadmaps in place. But the bigger picture is that encryption standards are going through their biggest change in decades, and post-quantum cryptography will soon be essential for all businesses hoping to work with the US government. Up to $3 billion of federal quantum projects are now either in operation or planned, including a $1.2 billion National Quantum Initiative.

The advent of quantum technology converges with the race for global tech supremacy as well as a period of turbulent geopolitics. The longer the government and businesses wait to act, the greater the potential harm.

Freddie Hudson is director for the Federal and Defense Sectors at PQShield, a cybersecurity company specializing in post-quantum cryptography. He is a retired Army Lieutenant Colonel and experienced defense contractor specializing in cyber/IT and Integrated Air and Missile Defense.

Article link: https://www.c4isrnet.com/thought-leadership/2023/01/20/pentagon-must-act-now-on-quantum-computing-or-be-eclipsed-by-rivals/

22 Sep 2022 

Artem Vlasov, IAEA Office of Public Information and Communication

Matteo Barbarino, IAEA Department of Nuclear Sciences and Applications

Seven Ways AI Will Change Nuclear Science and Technology

22 Sep 2022 

Artem Vlasov, IAEA Office of Public Information and Communication

Matteo Barbarino, IAEA Department of Nuclear Sciences and Applications

AI has the potential to advance the development of nuclear applications, science and technology. (Image: A. Vargas/IAEA)

Over the past decade, artificial intelligence (AI) has evolved rapidly, becoming increasingly sophisticated and capable of solving ever more complex problems. AI is deployed in sectors as diverse as manufacturing, transportation, finance, education and healthcare. In a similar vein, it has the potential to advance the development of nuclear applications, science and technology. Harnessing its capabilities in the nuclear field can positively contribute to addressing some of today’s most pressing challenges, from food security to climate change.

Here are some ways in which AI has and will continue to benefit the peaceful applications of nuclear technology. These are discussed in more detail in a new IAEA publication, Artificial Intelligence for Accelerating Nuclear Applications, Science and Technology.

1. Human health

AI can contribute to combating diseases. It is already applied to support the diagnosis and treatment of cancer through improved image interpretation and precise tumour contouring, enabling more accurate treatment plans and adaptive radiotherapy — a process tailored to the anatomical characteristics of the individual patient. The IAEA has recently launched a coordinated research project in this area.

AI will also play an important role in the IAEA’s Zoonotic Disease Integrated Action (ZODIAC) initiative to help experts better understand the impact of zoonotic diseases on human health and predict, assess and contain future outbreaks of such diseases.

2. Food and agriculture

AI tools combined with nuclear technologies can help make food systems more sustainable and climate change resilient, while also addressing food and nutrition insecurity.

Experts deploy AI to process and analyse data to increase crop yields, estimate soil moisture, remediate radioactively contaminated land, detect and predict food fraud events and improve irrigation.

3. Water and the environment

Isotopic methods allow experts to study and track how water moves through different stages of the hydrological cycle and what transformations occur in this cycle due to climate change. Experts already apply AI-based approaches to quickly analyse huge amounts of water-related isotopic data stored in global repositories, such as the Global Network of Isotopes in Precipitation maintained by the IAEA and the World Meteorological Organization.

Effective and efficient analysis of data facilitated with AI helps scientists understand climate change and its impact on water availability worldwide.

4. Nuclear science and fusion research 

Artificial intelligence plays an increasingly important role in nuclear science. AI are used in data analysis, theoretical modelling and experiment design, helping to accelerate fundamental research, for example in the realm of nuclear and atomic data evaluation and compilation, and advancing technological innovation.

A particular area that benefits from the application of AI is fusion research. With its ability to solve large and complex problems, AI can aid experiments and scientific discovery through modelling and simulations. These applications of AI are included in a new five-year IAEA coordinated research projectaimed at accelerating fusion research and development.

5. Nuclear power

Nuclear power is a reliable, low carbon source of energy, and it can benefit significantly from the inclusion of AI. By combining digital simulations of real nuclear facilities with AI systems, the industry can optimize complex procedures and improve reactor design, performance and safety. Such optimization can increase the efficiency of operations and reduce maintenance costs.

Machine learning — a process whereby AI learns by analysing large amounts of data — helps to automate tasks and thereby increase reliability and avoid errors. Furthermore, AI has considerable analytical and predictive potential to help monitor power plant processes and detect anomalies.

6. Nuclear security and radiation protection

As more and more countries choose to use nuclear technology for peaceful purposes and adopt nuclear power programmes, the IAEA works continuously to ensure the protection of people and the environment from the potential harmful effects of ionizing radiation.

AI can contribute to nuclear security and safety in several ways. It can be used in the processing of data from radiation detection systems to enhance the detection and identification of nuclear and other radioactive material. It can be applied to analyse data from physical protection systems to improve the detection of intruders. It can also help spot anomalies that could indicate a cyber-attack on a nuclear facility. Furthermore, in the realm of radiation protection, the integration of AI in safety standards-related software can reinforce the protection of the millions of workers with occupational exposure in medicine, construction, mining, shipping, agriculture and nuclear power.

7. Safeguards

Safeguards are technical verification measures through which the IAEA provides credible assurances that countries are honouring their legal obligations to use nuclear material for peaceful purposes only. The IAEA assesses states’ declared nuclear material and nuclear-related activities and seeks to verify the absence of undeclared ones through measures, such as inspections at nuclear facilities and sites.

Safeguards rely on large amounts of data obtained by various means, such as satellite imagery, environmental sampling, gamma ray spectroscopy and video surveillance. AI can help nuclear inspectors and safeguard analysts with the analysis of these data. Machine learning methods have already been used to detect outliers in large datasets and assist in verifying spent fuel and analysing surveillance recordings. AI is expected to further improve the efficiency of safeguards implementation by reducing the number of repetitive tasks performed by inspectors.

The way forward

The IAEA provides interdisciplinary fora for professionals to discuss and foster collaboration on the use of AI in nuclear applications, science and technology and is committed to sharing knowledge and forging partnerships through its AI for Atoms platform. As part of this initiative, the IAEA cooperates with the International Telecommunication Union, the UN Interagency Working Group on AIand almost 40 other UN organizations to provide a solid foundation for accelerated sustainable development with AI.

The AI for Good is a year-round digital platform of the United Nations system, where AI innovators and problem owners learn, discuss and connect to identify practical AI solutions to advance the United Nations Sustainable Development Goals.

Article link: https://m.facebook.com/story.php?story_fbid=pfbid02DZCcSmmySG2c7xMxysspsDpKG9tNwYX9e5ZAPiLto5V9tuYY33nR73iCuq6Po51Tl&id=100064786778246&mibextid=ncKXMA

Related stories

Nuclear Sector is Capitalizing on Opportunities in Artificial Intelligence, ITU-IAEA Events Hear

IAEA Teams up with ITU and UN Family to Promote AI for Good

The Future of Atoms: Artificial Intelligence for Nuclear Applications

The role of artificial intelligence and medical imaging in addressing zoonotic diseases

Related resources

• Artificial Intelligence for Accelerating Nuclear Applications, Science and Technology
• AI for Atoms
• AI for Good
• Inter-Agency Working Group on Artificial Intelligence
• 2021 UN Activities on AI Report

More

• Energy 
• Fusion 
• Health
• Cancer 
• Environment
• Water 
• Food and agriculture
• Industry 
• Security
• Radiation protection
• Safeguards and verification
• Department of Nuclear Energy
• Partnerships
• United Nations system
• Nuclear technology and applications
• Nuclear research
• Nuclear science
• Department of Safeguards
• Department of Nuclear Safety and Security
• Department of Nuclear Sciences and Applications

Last update: 23 Sep 2022 

More on the IAEA

1. Contact
2. Privacy Policy
3. Logo Usage Guidelines

Scientific resources

1. NUCLEUS
2. International Nuclear Information System (INIS)
3. Power Reactor Information System (PRIS)
4. Nuclear Data Services (NDS)

Resources

1. Employment
2. Gender at the IAEA
3. Press

Documents

1. Information Circulars
2. Treaties
3. Standards and guides
4. Safeguards and Additional Protocol

Stay in touch

        

Newsletter

Subscribe

International Atomic Energy Agency

Vienna International Centre, PO Box 100 
A-1400 Vienna, Austria 
Telephone: +43 (1) 2600-0, Facsimile +43 (1) 2600-7

 Official Email

© 1998–2023 IAEA, All rights reserved.Terms of Use

A new watchdog review found that federal agencies overseeing critical infrastructure have only implemented 43% of recommendations made since 2010.

More than half of the Government Accountability Office’s recommendations for protecting critical infrastructure services from cyber threats have not been implemented since 2010, potentially jeopardizing the security of the nation’s power grid and other vital services, according to a report issued by the watchdog Tuesday.

The report found that of the 106 public recommendations for bolstering cyber critical infrastructure that have been issued by the agency since 2010, only 46 have been implemented as of December 2022. 

“Until these are fully implemented, key critical infrastructures will continue to have increased cybersecurity risks to their systems and data,” GAO warned.

The report said that agencies need to focus on “strengthening the federal role in cybersecurity for critical infrastructure,” including placing a greater emphasis on enhancing their cybersecurity practices to account for shifting cyber threats. 

GAO cited a March 2021 report, which found that the Energy Department had “developed plans to help combat these threats and implement the national cybersecurity strategy for the grid,” but did not “address distribution systems’ vulnerabilities related to supply chains.”

“As a result, these plans will likely be of limited use in prioritizing federal support to states in addressing grid distribution systems’ cybersecurity,” the report said. 

Although GAO recommended that Energy “coordinate with the Department of Homeland Security, states and industry to more fully address risks to the grid’s distribution systems from cyberattacks” in its plans to implement the national cybersecurity strategy, the watchdog said that the agency has still not done so as of December 2022. 

“The U.S. grid’s distribution systems—which carry electricity from transmission systems to consumers and are regulated primarily by states—are increasingly at risk from cyberattacks,” the report noted. “Distribution systems are growing more vulnerable, in part because of industrial control systems’ increasing connectivity. As a result, threat actors can use multiple techniques to access those systems and potentially disrupt operations.”

GAO also said that the Cybersecurity and Infrastructure Security Agency “needs to assess the effectiveness of its programs and services to support the communications sector,” which faces a range of human-related, physical and cyber threats. 

GAO previously released a November 2021 report which warned that CISA “had not assessed the effectiveness of its programs and services supporting the security and resilience of the communications sector,” and “had not updated its 2015 communications sector-specific plan.” Although the watchdog recommended that CISA “assess the effectiveness of its programs and services to support the communications sector” and produce a revised plan, the agency had not implemented either recommendation by the end of 2022. 

Story Continues Below Sponsor Message

null

Additionally, GAO said that the increase in ransomware attacks—particularly those directed at critical infrastructure services—necessitates enhanced interagency coordination between the Department of Homeland Security and the Department of Justice. 

A September 2022 GAO report outlined how CISA, the FBI and Secret Service were working together to “provide assistance in preventing and responding to ransomware attacks on tribal, state, local and territorial government organizations,” but identified gaps in “aspects of six of seven key practices for interagency collaboration,” as well as concerns from respondents about “challenges related to awareness, outreach and communication.” 

While the report recommended that DHS and DOJ “address identified challenges and incorporate key collaboration practices in delivering services to tribal, state, local and territorial governments,” the watchdog’s recommendations remained unaddressed as of December 2022. 

Tuesday’s review is GAO’s third report in a four-part series on high-risk cybersecurity concerns that the federal government should immediately address. The previous two reports issued by GAO in its series similarly found that federal agencies were not doing enough to respond to identified vulnerabilities and operational deficiencies. 

The first review, released on Jan. 19, found that federal agencies had failed to implement almost 60% of the cybersecurity recommendations issued by the watchdog since 2010. The subsequent high-risk report, issued on Jan. 31, found that agencies had not fully implemented almost 21% of GAO’s recommendations for safeguarding federal systems and information since 2010.

Article link:https://www.nextgov.com/cybersecurity/2023/02/gaos-critical-infrastructure-cyber-recommendations-go-largely-unaddressed/382733/

By Dr. Darío Gil, Senior Vice President and Director of IBM Research

KEY POINTS

• Quantum computing technologies are rapidly progressing toward demonstrating application advantages for business and science.
• And while this progress creates risk to today’s encryption schemes, quantum-safe cryptography solutions that exist today will protect our most-critical data.
• The time is now for entire industries to understand how they can benefit from quantum computing, for organizations to educate their workforce — and for everyone to have a quantum-safe cryptography migration plan.

It’s been called the next big wave in computing. And it has the potential to revolutionize our approach to solving big problems, from how we discover new materials for a sustainable future to life-saving drugs to how we manage financial risk. I expect this to be the decade quantum computing arrives, but what exactly is it — and how does it impact the business world?

In short, it’s a way of computing that uses quantum physics to process information in a completely different way. Quantum computers approach complex problems differently by creating entangled multidimensional spaces where the patterns linking data can become clearer. Basically, they can find patterns that classical computers can’t. That means we have a completely new and different way to explore complicated problems that today’s computers can’t solve efficiently.

For the first time in the history of modern information technology, we will witness a fundamental new branch of computing emerge. As a scientist, I am thrilled about the possibilities of computing in the quantum realm, and as a business leader, I find these advances striking, particularly when I think about the potential applications. Carmakers, airlines, energy companies, healthcare providers, financial services firms and research organizations are already looking into quantum computing as a way to discover new products and services they could hardly have imagined a few years ago.As quantum computing becomes a reality, here’s what business leaders need to know.

Where quantum computers can help

Businesses are already looking at how they can use quantum computers to improve logistics, predict the price of financial options and research new materials for batteries. Daimler AG, for example, has been investigating how quantum computing could help develop next-generation lithium-sulfur batteries that could be more powerful and last longer than what’s available today. Bosch has begun exploring use cases in the field of materials science for fuel cells, electric engines and advanced sensors. And banks like HSBC are exploring the potential of quantum computing to develop new approaches to derivatives pricing, sustainability, risk and fraud.

Of course, it’s not always easy to know which problems a quantum computer can help with. That’s why businesses interested in how they could benefit from quantum also need to be thinking about the skillsets necessary to make the most of the new technology.

“As a scientist, I am thrilledabout the possibilities ofcomputing in the quantumrealm, and as a business leader,I find these advances striking,particularly when I think aboutthe potential applications.” 

How to build a quantum workforce

Right now, 29 universities worldwide have master’s degree programs in quantum technologies. I see an opportunity for businesses to step in and help higher education train tomorrow’s workers, including undergrads, with the skills they’ll need to help industry apply quantum computing. IBM is already working with almost 100 academic institutions around the world, including two dozen historically black colleges and universities (HBCUs), to help educate traditionally underrepresented students in quantum information science.

Another source of talent will come from upskilling the existing workforce by teaching them how to program today’s quantum computers. Tools exist today that can translate common programming languages into a language the quantum computer understands — making it easier for quantum computers to tackle a unique industry problem.

Although businesses will need highly skilled personnel to help put quantum computing to work, some areas of the technology will be familiar and integrate seamlessly with existing operations. Because quantum computing is delivered over the cloud, for example, most companies will not need to maintain the computers themselves. That means businesses can incorporate quantum computing into their existing hybrid cloud architectures.

I often get asked, how many employees should I dedicate to exploring quantum computing? The answer is never zero.

Act now to keep your business secure

Amid the buzz about quantum computing are concerns that these machines will be able to break modern encryption — and business leaders are right to be concerned. While there’s been recent speculation that an algorithm, designed for classical computers, might be able to harness existing quantum computers to crack today’s most widely used protection schemes, let me be clear: this research has not been verified, and we have a long way to go before any quantum computer has the capability to decrypt RSA-protected data.

However, bad actors are already using an approach best described as “harvest now, decrypt later,” which means data can be stolen now and stored in the hopes of using a future quantum system for decryption. Thankfully, new quantum-safe approaches to encryption exist, have been verified by peer review-published research, are under consideration for government standards and can already be put in place to protect data and systems now for when that day comes.

Plan for the future of computing

Government funding and attention has raised quantum computing’s profile higher than ever, in part thanks to the National Quantum Initiative and the CHIPS and Science Act. These laws help fuel the future of quantum by accelerating research, expanding the quantum supply chain and providing more opportunities for researchers to explore business and science applications of quantum systems.

The bottom line for businesses is that now is the time to figure out how you’re going to take advantage of quantum computing. A true quantum industry is emerging with a growing ecosystem of startups, academia, national labs and industry partners using quantum computing devices every day — and this is just the beginning.

Article link: https://www.cnbc.com/advertorial/2023/02/07/what-business-leaders-need-to-know-about-quantum-computing.html

Save the Date: Feb 16, 2023 – Cloud Applications and Development #CBNE

Beginning at 3pm followed by a networking happy hour at Coffee Bar 1010 at 4pm.

This CBNE we will be discussing the latest advancements in cloud applications and development technology. Join industry, academia, and government leaders to discuss topics such as developing cloud-based applications, deploying and scaling cloud applications, and other related topics. You will also have the opportunity to network with peers and get valuable insight into the current state of cloud computing.

https://lnkd.in/er3gjQp8

work #opportunities #share #networking #connections #like #event #events #engagement #cyber #cybertraining #quanticocyberhub #cyberbytesfoundation #cyberseminar #cybersecurity #cybersecurityawareness #cyberdefense #cybernews #cyberawareness #cybereducation #cybermixer #innovation #technology #technologytrends #technologysolutions #technologyjobs #networkingevent #networkingopportunities #networkingbusiness #cloudcomputing #opportunity #development #cloud #network #leaders #coffee

♦️Amanda S. | Jonathan Payton | Joel Scharlat | Matthew Weaver | Kaleb Hunter | Katharine Reinboldt | Jeff Rose | Michael Schwartz and CHEVERLY | Donovan Applewhite | Luke Wright | Sam Hanson | Steve Karam | Dr. Paul de Souza |

By ALEXANDRA KELLEYFEBRUARY 3, 2023

NIST leadership commented on the need for a tailored approach to artificial intelligence risk management, and how understanding an industry is key to anticipating AI system risks.

On the heels of the launch of its debut Artificial Intelligence Risk Management Framework, the National Institute of Standards and Technology continues to posture its standards-setting approach to prioritize human engagement with emerging technologies. 

One detail that NIST researchers may target in forthcoming editions of their AI RMF guidance is a set of more tailored recommendations on AI and machine learning algorithms for different industries, according to an agency official. 

Elham Tabassi, the chief of staff in the Information Technology Laboratory at NIST, spoke in a Friday discussion hosted by the George Washington University and expanded upon the new AI RMF’s purpose and applications.

While the RMF was designed to be broadly applicable to a variety of use cases as a general, high-level framework, Tabassi said she ultimately thinks that AI risk management techniques should vary between different sectors and implementation is best conducted with the help of groups with domain expertise. 

“AI is all about context and use case, and how either of these trustworthy characteristics…will manifest themselves in different use cases in [the] financial sector, versus hiring, versus face recognition…and they may have different priorities,” she said. “There is need for a tailored guidance to that specific technology or use case.”

She added that conversations have already begun on developing a tailored AI RMF for specific applications. An updated version of the accompanying AI playbook authored by NIST is slated to be released in Spring 2023.

“What we were trying to do is giving some general, technology-agnostic, sector-agnostic framework, but strong enough foundation that all these verticals could be built up,” she said. 

Tabassi also noted that, in the open-comment period to collect feedback and input on the current AI RMF, NIST received over 400 sets of comments from people in government, academia and the private sector.

Article link: https://www.nextgov.com/emerging-tech/2023/02/future-nist-ai-guidance-could-take-industry-specific-approach/382575/

From frameworks to new federal offices it’s time to get busy

Jeff BurtSun 5 Feb 2023  //  12:00 UTC

25 

---

The hack of SolarWinds’ software more than two years ago pushed the threat of software supply chain attacks to the front of security conversations, but is anything being done?.

In a matter of days this week, at least four disparate efforts to shore up supply chain security were declared, an example of how front-of-mind such risks have become and a push from vendors and developers to reduce them.

The threat is growing. Gartner expectsthat by 2025, 45 percent of organizations globally will have experienced a software supply chain attack, a three-fold jump from 2021. It’s not a surprise, according to Neatsun Ziv, CEO of startup Ox Security that’s building an open MITRE ATT&CK-like framework for enterprises to check software supply chains.

“These kinds of attacks become super, super lucrative just because the [hits] that you could get from a single weapon is not proportional to anything else you see in the industry,” Ziv told The Register.

As with the SolarWinds attack, a miscreant can inject malicious code into a piece of software before the compromised software is sent out to customers and compromises those systems. Organizations seem to be slow in catching up to this.

More recently, attackers have targeted code repositories like GitHub and PyPIand companies like CI/CD platform provider CircleCI, an incident that expanded the definition of a supply chain attack, according to Matt Rose, field CISO for cybersecurity vendor ReversingLabs.

“What the CircleCI incident illustrates is that organizations have to not only be concerned about malware being injected into a compiled object or deliverable, but also of the tooling used to build them,” Rose wrote in a blog post. “That’s why the CircleCI hack is an eye opener to a lot of organizations out there.”

One framework for them all

The OSC&R (Open Software Supply Chain Attack Reference) was launched this week, founded by Ziv – former vice president of cybersecurity at Check Point – and other security pros with background at such places as Google, Microsoft, GitLab, and Fortinet.

The idea is to give enterprises a common framework for evaluating and measuring the risk to their supply chains, something that has traditionally been done with intuition and experience. OSC&R will give organizations a common language and tools for understanding the attack tactics and defenses, prioritize threats, and track threat group behavior.

It will be updated as new tactics crop up, will help with red-team penetration exercises, and will take contributions from other vendors. The group took concepts for ransomware and endpoints used in MITRE ATT&CK and applied them to the supply chain.

“The challenge was that there was no framework to get us from a basic understanding to our ability to check our environment if we are susceptible to the supply chain attacks,” Ziv said.

The framework touches on nine key areas – such as container and open-source security, secrets hygiene, and CI/CD posture – and outlines the techniques used by attackers in such areas as initial access, persistence, privilege escalation, and defense evasion. It will grow in both features and contributors, he said.

The OpenVEX spec

In the same spirit, supply chain security vendor Chainguard is heading up a group that includes HPE, VMware, and The Linux Foundation to jumpstart the adoption of the Visibility Exploitability eXchange (VEX), a tool for addressing vulnerabilities in enterprise software. It’s supported by agencies like the US National Telecommunications and Information Administration (NTIA) and Cybersecurity Infrastructure Security Agency (CISA).

Enter the OpenVEX specification and reference toolchain

“Up until today, VEX has been a concept the industry has invested time debating and building minimum requirements around,” Chainguard founder and CEO Dan Lorenc wrote. “With the release of OpenVEX, organizations can now put VEX into practice.”

OpenVEX will work as a companion to software bill of materials, which help with transparency but can create “noise” in the industry, Lorenc wrote. With OpenVEX, suppliers can more precisely describe how exploitable the products are and help end users filter out false positives.

Chainguard has put OpenVEX in some of its products, including its Wolfi container-specific Linux distribution and Images secure-by-default container base images.

For its part, cybersecurity vendor Checkmarx is building onto the supply chain security offering it released in March 2022 with a threat intelligence tool to focuses on the supply chain. It includes information such as identifying malicious packages by the type of attack – like typosquatting or dependency confusion — analysis of the operators behind the attack, how the packages operate, and the historical data behind them.

“This intel is all about tracking purpose-built, malicious packages that often contain ransomware, cryptomining code, remote code execution, and other common types of malware,” wroteStephen Gates, principal content marketing manager for Checkmarx.

CISA on the move

CISA reportedly is creating an office to address supply chain security and work with the public and private sectors to put federal policies in place. According to a report in the Federal News Network, Shon Lyublanovits is leading the initiative. She heads the project management office for cyber supply chain risk management (C-SCRM), which is part of CISA’s cybersecurity division.

The issues the office will address range from counterfeit components to open-source software vulnerabilities.

It’s the latest step for CISA, which has had a focus on supply chain security since creating a task force for IT and communications technology task for in 2018.

Varun Badhwar, co-founder and CEO at supply chain security vendor Endor Labs, applauded CISA’s decision to create the office, telling The Registerthat establishing “a new capability at such a high level stands out as a milestone.”

However, it’s important to understand the complexities of the problem, Badhwar said. There are open-source components through the software lifecycle and organizations need to first secure the open-source software they use. Enterprises and agencies use an average of more than 40,000 open-source software packages downloaded by developers, and each of those can bring in another 77 dependencies.

“This causes a massive, ungoverned sprawl that increases the supply chain attack surface across multiple dimensions,” he said, adding that Endor Labs has found that 95 percent of open source vulnerabilities are found in the transitive dependencies.

Article link: https://www.theregister.com/AMP/2023/02/05/supply_chain_security_efforts/

By ALEXANDRA KELLEYFEBRUARY 1, 2023

The congressmen have been using artificial intelligence systems to write Congressional texts, as they push for both regulation and innovation in the field.

Two members of the House made waves last week by employing advanced technology to advocate for greater regulation of itself. Reps. Ted Lieu, D-Calif., and Jake Auchincloss, D-Mass., spearheaded conversation about the need for legislative action on artificial intelligence, by using such systems to write a bill and a speech for the House floor, respectively.

Both congressmen, who each have backgrounds in tech sectors, have been busy introducing legislation to regulate and responsibly foster development in the AI sector. Lieu introduced the first bill in Congress that was written with AI, using the popular software ChatGPT. 

Speaking with the Washington Post in a live interview on Wednesday, Lieu described the process of using AI to write a proposed piece of legislation as “enthralling,” and also concerning.

“I was blown away by how well it wrote that first paragraph and the fact they could do it [in] under a minute,” he said. “I was also deeply alarmed that it was able to write an amazing paragraph in under a minute that largely aligned with my own views.”

Lieu detailed his experience in writing a bill with AI technology to make a case for sophisticated federal legislation.

“We need to make sure that we use AI for good but also keep it from doing harm to society,” he said. 

Auchincloss made a similar play, reading out an AI-generated speech on the House floor when reintroducing the United States–Israel Artificial Intelligence Center Act, which would foster collaboration in AI research and development between the two nations. 

Speaking to Nextgov, Auchincloss said that his motivation to advocate for more AI research efforts and regulation within the U.S. stemmed from the looming ubiquitousness of machine learning systems. 

“This technology [AI]—I know—is going to be part of my career for decades to come. And it could be a general purpose technology for my children, meaning that, in any sector that they chose to work, it would be a key tool that they would need to use,” he said. “I wanted to spotlight this for Congress so that we have a debate now about purposeful policy for AI and not be 10 years behind the ball, like I think a lot [of] policy was for social media.” 

Lieu spoke in favor of regulations for AI, and noted that government should be prioritizing the specific technology systems that demand oversight due to their threat potential, such as national security systems or those that could impact road safety through augmented vehicles.

“I don’t think it’s possible to regulate artificial intelligence in every discrete instance in which it is used,” he said. “I think a better approach is to have a general agency do regulations. And also, when an agency gets it wrong, they can also reverse the decision without having to get another act of Congress to change whatever it is that they initially did.”

As the newest member appointed to the House Committee on Science, Space and Technology, Lieu confirmed he will continue to focus on marrying AI innovation with responsibility—through an announcement written by an AI chatbot. Lieu assured communication staffers that their jobs were not in danger of AI replacement in that same press release.

Lieu conceded during  the Washington Post event that AI will cause some level of disruption to the overall job market, both in the elimination and creation of jobs. 

To determine the broad impact of AI and how Congress can mitigate the negative and emphasize the positive, Lieu called for a “blue ribbon committee” staffed with experts from industry and academia to help the government navigate AI’s societal impacts. 

“It is very important, I think, to have stakeholders and experts—from industry, from government, from academia and other places—look at these issues and really make some good recommendations for Congress on how we proceed forward and what is going to be [an] enormous disruption in the next few years,” he said.

Article link: https://www.nextgov.com/emerging-tech/2023/02/why-2-lawmakers-turned-ai-advocate-its-own-regulation/382458/

By VIRAL CHAWDA AND ANDY GOTTSCHALK JANUARY 31, 2023 09:00 AM ET

Citizens are demanding a more connected government.

Change is seldom easy. Yet for government and public sector executives, the need to modernize has never been greater, as there is a growing digital divide between constituent expectations and what many governments can offer. The COVID-19 pandemic shifted the dynamic when it came to the digital imperative for government. More than ever, citizens are demanding a more connected government with integrated services, relevant experiences and self-driven service connection. Whether it’s paying taxes online or applying for benefits anytime and anywhere with the ease experienced in other aspects of their lives, citizens are seeking a government that is as modern as the technology they use in their daily lives. A failure to move forward with modernization efforts will only lead to a decline in government agencies’ ability to deliver services and potentially reinforce the prevailing view of government as inefficient, out of touch and ambivalent to the needs of its constituents. 

Today, some agencies are relying on legacy systems running programs that are more than a quarter century old and can no longer be supported or updated. Converting systems and applications of that age, scale and complexity to modern cloud-based solutions is difficult. And finding the right talent to orchestrate the change is not easy either. By contrast, leading agencies will move into the future by aggressively pursuing new technologies such as cloud, artificial intelligence, blockchain, low code platforms and analytical engineering. By some estimates, with digital transformation, savings for governments could exceed $1 trillion over the course of the next decade.  

As government and public sector agencies continue on their digital transformation journey this year, here are five strategies to adopt moving forward:

1. Have a customer-centered design mindset when introducing new technology so that users will find new platforms and applications easy to use and will embrace them.
2. Begin treating data like a product to be shared enterprisewide rather than continually duplicated in siloed departments. 
3. Accelerate the use of a development, security and operations—DevSecOps—approach to creating new software applications, embedding security into them from the outset. 
4. Continue to modernize technology stacks to include SaaS platforms, advanced cloud, AI and edge computing capabilities—as well as strong data management capabilities—and make it easy for end users to access the data insights they need for decision-making. 
5. Embrace modularity and containerization to help with the challenge of modernizing large and complex legacy systems and applications. Modularity refers to dividing large software applications into smaller modules, while containerization refers to running those applications in an isolated environment.

Modernization is now more important than ever to bridge the digital divide and meet constituents’ rising expectations. These are just some of the many steps governments should consider as they continue on their digital journeys.

Viral Chawda is a principal and head of government technology at KPMG U.S. and Andy Gottschalk is a partner for health and government solutions at KPMG U.S. The views expressed are the authors alone and do not necessarily represent those of KPMG LLP.

Article link: https://www.nextgov.com/ideas/2023/01/closing-digital-divide-government-5-strategies-digital-transformation/382326/

By William C. Greenwalt AEIdeas January 26, 2023

As the US wrestles with a rapidly changing security environment, the creation of new military capabilities to counter these growing threats is essential. Defense leaders are being forced to relearn, as they have had to do in every conflict since the Revolutionary War, that one cannot just turn on a spigot and obtain weapons on demand. Industrial base constraints reliably manifest themselves in multi-year lead times such as we are seeing today to replace munitions used in Ukraine. Our quandary, however, is much greater than just reconstituting peacetime stocks of existing systems. Any impending conflict, or perhaps more optimistically the ability to deter a future conflict, will require not only production at scale, but innovation at scale that hasn’t been seen since WWII and the early Cold War.

The US is nowhere near being ready to embark on such an effort. Before doing so the Department of Defense (DOD) and Congress need to understand the depths of the issues that are holding back America’s ability to regain the level of technological dominance necessary to maintain deterrence or prevail in a war if deterrence fails. The following twelve problem areas are offered to begin to frame that understanding. We need to focus our attention on the right problems, as well-intended solutions to the wrong ones will end up just exacerbating our decline. This is not an all-inclusive list. One could easily nail 95 innovation theses to the doors of the Pentagon if security would allow it. Still, this represents an initial attempt to identify some of the more significant barriers that will prevent US military success unless we act soon. 

1) There is no sense of urgency yet. Defense management systems and the industrial base are optimized for a peacetime cadence after 30 years without a Great Power conflict. It took years to get to this point and without focused leadership we will never adjust to a different set of circumstances.

2) Process compliance is our most valued objective rather than time. Time to operational capability as described in the report “Competing in Time” has been the primary historical forcing function for disruptive innovation, and yet it is not valued in DOD or Congress.  

3) We are all communists now. Just as was the case in the Soviet Union, centrally planned, linear, predictive processes and mindsets destroy innovation and creativity. These processes took root at DOD in the 1960s under McNamara and have had 60 years to engrain themselves in culture.

4) Budget inflexibility in year of execution and long lead times to allocate resources are at the root cause of our declining competitiveness and innovation failures (especially in the many versions of the Valley of Death).

5) The predictive and lumbering requirements process forecloses innovation opportunities from the start as it is the gateway to the acquisition and budgeting system.

6) Operational interests are not aligned or supported within the acquisition and budgeting systems – both at the combatant command and service component command levels. 

7) The barriers to civil-military integration of the industrial base have continued to widen as DOD prefers to dictate solutions to defense unique monopoly providers that have taken on many of the characteristics of pre-WWII government run arsenals.

8) Defense contracting has become more of an enforcer of socio-economic programs and goals than an enabler of capability. Unique non-market rules keep out non-traditional and commercial companies and solutions and drive-up costs.

9) The authority and ability of program officials to do their jobs has been limited by adversarial oversight. Incentives and rules drive contracting officer enforcement of process rather than capability outputs or program objectives. Testing, technology, and auditing bureaucracies double down on “gotcha” check the box oversight rather than provide cooperative insights and proactive value add. 

10) Production capability is a key component to innovation and has been allowed to deteriorate both in the traditional and commercial industrial bases. DOD ignored the implications of the last two decades of commercial globalization and production outsourcing to China that has hollowed out the US industrial base. Just in time efficiency requirements and barely minimal sustainable production rates have destroyed defense specific industrial capabilities and undermined military readiness. 

11) Incentives for industry are not aligned to DOD innovation interests. The preponderance of cost contracts, counterproductive reimbursement rates and policies, and lack of program opportunities have left the traditional defense industrial base and government organic depots to be built around long-term maintenance revenues and decades long weapon systems franchises making it politically difficult to modernize. 

12) Security and technology control policies (ITAR) are built around an era of US defense technological dominance that has long passed and now serve as barriers to innovation. Both Silicon Valley and allied cooperation will be needed to compete against China but outdated thinking and processes hinder such cooperation.

Article link: https://www.aei.org/foreign-and-defense-policy/defense/twelve-problems-negatively-impacting-defense-innovation/