healthcarereimagined

A Q&A with NCC Group’s Viktor Gazdag ahead of a Black Hat USA session on CI/CD pipeline risks reveals a scary, and expanding, campaign vector for software supply chain attacks and RCE.

Tara Seals Managing Editor, News, Dark Reading. August 09, 2022

Continuous integration/continuous development (CI/CD) pipelines may be the most dangerous potential attack surface of the software supply chain, researchers say, as cyberattackers step up their interest in probing for weaknesses.

The attack surface is growing too: CI/CD pipelines are increasingly a fixture within enterprise software development teams, who use them to a build, test, and deploy code using automated processes. But over-permissioning, a lack of network segmentation, and poor secrets and patch management plague their implementation, offering criminals the opportunity to compromise them to freely range between on-premises and cloud environments. 

At Black Hat USA on Wednesday, Aug. 10, Iain Smart and Viktor Gazdag of security consultancy NCC Group will take to the stage during “RCE-as-a-Service: Lessons Learned from 5 Years of Real-World CI/CD Pipeline Compromise,” to discuss the raft of successful supply chain attacks they’ve carried out in production CI/CD pipelines for virtually every company the firm has tested.

NCC Group has overseen several dozen successful compromises of targets, ranging from small businesses to Fortune 500 companies. In addition to security bugs, the researchers say novel abuses of intended functionality in automated pipelines have allowed them to convert pipelines from a simple developer utility into remote code execution (RCE)-as-a-service.

“I hope people will give some more love to their CI/CD pipelines and apply all or at least one or two recommendations from our session,” Gazdag says. “We also hope this will spark more security research on the topic.”

Tara Seals, Dark Reading’s managing editor for news, sat down with Viktor Gazdag, managing security consultant of NCC Group, to find out more. 

Tara Seals: What are some of the more common security weaknesses in CI/CD pipelines, and how can these be abused?

Viktor Gazdag: We see three common security weaknesses regularly that require more attention:

1) Hardcoded credentials in Version Control System (VCS) or Source Control Management (SCM). 

These include shell scripts, login files, hardcoded credentials in configuration files that are stored at the same place as the code (not separately or in secret management apps). We also often find access tokens to different cloud environments (development, production) or certain services within the cloud such as SNS, Database, EC2, etc. 

We also still find credentials to access the supporting infrastructure or to the CI/CD pipeline. Once an attacker gets access to the cloud environment, they can enumerate their privileges, look for misconfigurations, or try to elevate their privileges as they are already in the cloud. With access to the CI/CD pipeline, they can see the build history, get access to the artifacts and the secrets that were used (for example, the SAST tool and its reports about vulnerabilities or cloud access tokens) and in worst case scenarios, inject arbitrary code (backdoor, SolarWinds) into the application that will be compiled, or gain complete access to the production environment.

2) Over-permissive roles. 

Developers or service accounts often have a role associated with their accounts (or can assume one) that has more permissions than needed to do the job required. 

They can access more functions, such as configuring the system or secrets scoped to both production and development environments. They might be able to bypass security controls, such as approval by other developers, or modify the pipeline and remove any SAST tool that would help searching for vulnerabilities. 

As pipelines can access production and test deployment environments, if there is no segmentation between them, then they can act as a bridge between environments, even between on-prem and cloud. This will allow an attacker to bypass firewalls or any alerting and freely move between environments that otherwise would not be possible.

3) Lack of audit, monitoring, and alerting. 

This is the most neglected area, and 90% of the time we found a lack of monitoring and alerting on any configuration modification or user/role management, even if the auditing was turned on or enabled. The only thing that might be monitored is the successful or unsuccessful job compilation or build.

There are more common security issues, too, such as lack of network segmentation, secret management, and patch management, etc., but these three examples are starting points of attacks, required to reduce the average breach detection time, or are important to limit attack blast radius. 

TS: Do you have any specific real-world examples or concrete scenarios you can point to?

VG: Some attacks in the news that related to CI/CD or pipeline attacks include:

• CCleaner attack, March 2018
• Homebrew, August 2018
• Asus ShadowHammer, March 2019
• CircleCI third-party breach, September 2019
• SolarWinds, December 2020
• Codecov’s bash uploader script, April 2021
• TravisCI unauthorized access to secrets, September 2021

TS: Why are weaknesses in automated pipelines problematic? How would you characterize the risk to companies?

VG: There can be hundreds of tools used in pipeline steps and because of this, the tremendous knowledge that someone needs to know is huge. In addition, pipelines have network access to multiple environments, and multiple credentials for different tools and environments. Gaining access to pipelines is like getting a free travel pass that lets attackers access any other tool or environment tied to the pipeline.

TS: What are some of the attack outcomes companies could suffer should an adversary successfully subvert a CI/CD pipeline?

VG: Attack outcomes can include stealing source code or intellectual data, backdooring an application that is deployed to thousands of customers (like SolarWinds), gaining access to (and freely moving between) multiple environments such as development and production, both on-prem or in the cloud, or both.

TS: How sophisticated do adversaries need to be to compromise a pipeline?

VG: What we’re presenting at Black Hat are not zero-day vulnerabilities (even though I found some vulnerabilities in different tools) or any new techniques. Criminals can attack developers via phishing (session hijack, multifactor authentication bypass, credentials theft) or the CI/CD pipeline directly if it’s not protected and is Internet-facing. 

NCC Group even performed security assessments where we initially tested Web applications. What we found is that CI/CD pipelines are rarely logged and monitored with alerting, other than the software building/compiling job, so criminals don’t have to be that careful or sophisticated to compromise a pipeline.

TS: How common are these types of attacks and how broad of an attack surface do CI/CD pipelines represent?

VG: There are several examples of real-world attacks in the news, as mentioned. And you can still find, for example, Jenkins instances with Shodan on the Internet. With SaaS, criminals can enumerate and try to brute-force passwords to get access as they don’t have multifactor authentication enabled by default or IP restrictions, and are Internet-facing.

With remote work, pipelines are even harder to secure as developers want access from anywhere and at any time, and IP restrictions aren’t necessarily feasible anymore as companies are moving towards zero-trust networking or have changing network locations.

Pipelines usually have network access to multiple environments (which they shouldn’t), and have access to multiple credentials for different tools and environments. They can act as a bridge between on-prem and cloud, or production and test systems. This can be a very wide attack surface and attacks can come from multiple places, even those that have nothing to do with the pipeline itself. At Black Hat, we’re presenting two scenarios where we originally started off with Web application testing.

TS: Why do CI/CD pipelines remain a security blind spot for companies?

VG: Mostly because of the lack of time, sometimes the lack of people, and in some cases, lack of knowledge. CI/CD pipelines are often created by developers or IT teams with limited time and with a focus on speed and delivery, or developers are just simply overloaded with work.

CI/CD pipelines can be very or extremely complex and can included hundreds of tools, interact with multiple environments and secrets, and be used by multiple people. Some people even created a periodic table representation of the tools that can be used in a pipeline.

If a company allocates time to create a threat model for the pipeline they use and the supporting environments, they will see the connection between environments, boundaries, and secrets, and where the attacks can happen. Creating and continuously updating the threat model should be done, and it takes time.

TS: What are some best practices to shore up security for pipelines?

VG: Apply network segmentation, use the least-privilege principle for role creation, limit the scope of a secret in secrets management, apply security updates frequently, verify artifacts, and monitor for and alert on configuration changes.

TS: Are there any other thoughts you would like to share?

VG: Although cloud-native or cloud-based CI/CD pipelines are more simple, we still saw the same or similar problems such as over-permissive roles, no segmentation, over-scoped secrets, and lack of alerting. It’s important for companies to remember they have security responsibilities in the cloud as well.

Article link: https://www.darkreading.com/application-security/software-development-pipelines-cybercriminals-free-range-access-cloud-on-prem

By Lieutenant Commander Derek Bernsen, U.S. Navy

August 2022 Proceedings Vol. 148/8/1,434

The Navy is currently the least capable military service for cyber operations and security. While the first computer network attack capabilitiesoriginated from the Navy in the 1970s and 80s, the service has since backslid into mediocrity. Even the House Armed Services Committee (HASC) has noticedand included provisions in the draft 2023 National Defense Authorization Act to force an overhaul of Navy cyber.

The problems in Navy cyber communities and commands—and with its cyber concepts—result in a negative feedback loop. The Navy does not have sufficient cyber capabilities and forces, and instead relies on joint and other services. The Navy is also the only military branch without service-retained offensive cyber units—without which cyber personnel have limited ability to show their value to the fleet. Because of this, Navy leaders are left wondering why cyber is important to Navy missions, and how to integrate cyber into existing capabilities. This leaves Navy cyber sidelined, unsupported, and unable to directly integrate into Navy warfighting capabilities beyond joint operations. Our maritime adversaries understand cyber as a key component in warfare, so it is imperative the Navy fix the feedback loop stemming from these areas.

Problems with the Cyber Community

The Navy’s undervaluation of and apathetic approach to cyber has created a negative feedback loop within its community. Structural community issues (as I explained in my earlier article here) showcase a community struggling to grow.

Recent naval investments in cyber have been theater at best. For example, creating the cyber operations major at the U.S. Naval Academy (along with a $143 million cyber building), while preventing midshipman completing the cyber operations major from commissioning as cyber warfare engineers (CWEs). In 2022, the Academy only graduated four midshipmen skilled enough to be selected as CWEs—all computer science majors. Only two of those four were permitted to become CWEs. The others two were initially forced into surface warfare and aviation communities. A third was later allowed to become a CWE due to a medical disqualification. Meanwhile, the Marine Corps selected seven Naval Academy graduates for its cyber community, and the Army selected 40 West Point graduates for its cyber community. This was after Congress was told in 2018 that the Navy’s investment at the Academy would yield 30 CWEs each year. Thus far, there have only been six.

The Navy’s actions have made it clear that it would prefer to have computer science and cyber operations majors fill arbitrary billets in warfare communities unable to meet their retention requirementsrather than do what they were trained for—protect U.S. interests in cyberspace. While not all graduates would want a cyber career over another operational community, clearly those that endure the rigorous CWE accessions process desire such a career and are placed elsewhere.

No Real Cyber Commands

Compounding personnel problems, Navy information warfare community (IWC) commands are not structured to support cyber. Unlike their counterparts in the other services, such as the Army’s 915th Cyber Warfare Battalion, Navy units do not conduct offensive cyber operations. While Chief of Naval Operations Admiral Michael Gilday recognized this discrepancy and called for service-retained cyber forces and capabilities in the form of tactical cyber units, the Navy has yet to establish one. While the Navy does have a few dedicated cyber protection teams conducting defensive operations, it lacks any Navy personnel conducting offensive cyber operations for Navy missions. This feeds a perception among Navy leaders that cyber is a joint mission and that the service gets little to no benefit for supporting joint offensive cyber operations. Anything the Navy does to improve its cyber training and manning pipeline will not contribute to the Navy’s mission.

Navy Cyber Warfare Development Group (NCWDG) appears to be the exception, but it is plagued by similar joint issues. The name “Cyber Warfare Development Group” may lead readers to believe that NCWDG is solely cyber focused. But NCWDG is a multifaceted monster. Its components have competing responsibilities including research and development, acquisitions, special technical capabilities, and coordinating work with all national level agencies for not just cyber, but for all cryptologic functions. Additionally, NCWDG is responsible for planning and executing U.S. Title 10 (defense) and Title 50 (intelligence) information warfare and cyber operations, is a force provider to the cyber mission force, and operates the Navy’s signals analysis labs.¹ It is simply doing too much to focus on cyber. On top of this, because the NCWDG commander must be an acquisitions professional, it is rarely led by someone with relevant cyber operations expertise. NCWDG is good despite its structure, not because of it.

Problems with the Navy’s Cyber Concept

Navy strategy on cyber is shortsighted, and Navy leaders are ill equipped to develop a more forward-looking strategy. This is because the Navy has no command with a single cyber focus contributing directly to a Navy mission.

The Navy has always been slow to adapt because of deeply ingrained cultural issues, stubborn adherence to outdated traditions, and a refusal to advance its thinking. Rear Admiral William S. Sims explained this in a 1921 addresson military conservatism to that year’s Naval War College graduates. He states, “arguments in favor of fundamentally new weapons have failed except those that resulted in shedding the blood of the unbelievers; that defeat alone has been accepted as a final demonstration.” For a domain that evolves as quickly as cyber does, this culture is doubly concerning.

In addition, Navy leaders lack technical depth in the cyber arena. It has become acceptable for leaders to say “I don’t understand cyber” in Congressional hearings. In addition, because few commands contribute cyber capabilities directly to Navy missions or focus solely on cyber, few Navy leaders see the true benefits of cyber or understand how cyber operations work in a military context. Thus, Navy leaders either get their understanding of cyber operations from hacker movie stereotypes, or do not think cyber adds any value to warfighting. Clearly Navy leaders have recognized this as they recently selected yet another aviator to lead Fleet Cyber Command rather than a flag officer from the cryptologic warfare communities, despite the fact that these communities notionally lead the Navy’s cyber missions.

The 2023 Draft NDAA Proposal

Congress is clearly frustrated and has recently stepped in via provisions in the draft 2023 NDAA to force change in Navy cyber. Specifically, HASC has included language to “establish a cyber warfare operations designator . . . separate from the [CWO],” “establish cyberspace operations as a military discipline that is a separate community from the [IWC],” and prohibit non-cyber personnel from working in cyber fields. These provisions, if passed, will make a huge impact, but there is still room for interpretation on implementation. The Navy must consider how it implements these carefully or risk continuing stagnation.

If the NDAA passes with its current or similar language, the Navy must remove cyber tasks from the CWO and IP communities, allowing them to refocus on their traditional areas of expertise. While the IP community has traditionally filled cyber roles (e.g., red/blue teams, computer network defense, etc) and non-cyber IT roles (e.g. system/network administration, infrastructure maintenance, IT account management, etc), the establishment of a cyber designator, as described in the NDAA, necessitates consolidating all cyber roles in one community. The next step is to deliberately nurture its technical communities, and this can be done in one of two ways. The Navy can either make the CWE community responsible for everything cyber, or split cyber to empower the CWE community while also establishing a cyber operations officer (COO) community for less technical roles.

The all-CWE option ensures the Navy has the best cyber personnel in every role. Expanding the CWE community to take full control, responsibility, and accountability for cyber operations ensures that every CWE officer has a deep technical understanding and cyber-focused experiences, making it the best long-term solution. All cyber jobs benefit from a technical background, even if they are less technically demanding. Growing a community with a deep technical foundation will enable the Navy to conduct maritime cyber operations and develop concepts to bring it back to the cutting edge and lead in the cyber domain.

A COO community would, unlike the current cryptologic warfare community, be wholly focused on cyber and receive technical training, but would focus on the less technically demanding roles in cyber. This community would fill a large portion of cyber roles while allowing the CWEs to modestly expand, remaining an elite and lean community. This builds two communities with technical backgrounds—one focused on pushing the cutting edge and another on the less-technical day-to-day cyber work (e.g., system administration) and community management (e.g. detailing). The Navy would still need to grow the CWE community and foster a relationship between CWEs and COOs. While COOs may get enough focus to be capable in cyber, they would need to know when to call on CWEs for their technical insight. Leadership roles must be shared by the two communities. For example, a COO leadership role must be accompanied by a CWE deputy and vice versa to take advantage of their complementary skills. Failure to align these two communities would result in short-term improvement but long-term stagnation.

If given the choice, the Navy should opt for growing the CWE community and include their rigorous accessions process and strict technical depth. The potential pitfalls of a less technical COO community are too great and would result in Congress being forced to take another heavy-handed move to solve a problem the Navy will not address on its own.

New Cyber Commands

The Navy should establish new commands that focus solely on cyber. Creating service-retained cyber units whose sole responsibility is some aspect of cyberspace operations creates a foundation to build genuine expertise. Commands that already exist in this space, such as NCWDG, should split themselves into more focused commands. There is even precedent for this given Navy Information Operations Command Maryland’s split in 2017. Navy units whose sole mission is cyber are required to develop concepts and capabilities for maritime cyber—something joint and other service units have no reason to prioritize.

Eventually, cyber will need to be integrated with units across the various other Navy warfare domains (surface, subsurface, special warfare, etc.) to maximize the cross-over advantages of cyber effects. Doing so before building dedicated cyber units that regularly produce experts will not be successful. Instead, dedicated cyber units should be where cyber professionals first cut their teeth before being attached to other units to employ their expertise.

Just as the Navy does not request the Air Force’s permission to fly planes, the Navy needs its own capabilities to operate without requesting to use joint or other service capabilities and personnel. Dedicated Navy defenders will be more experienced with the Navy networks and systems. Similarly, offensive professionals would be intimately familiar with the intricacies of maritime cyber and be able to develop capabilities and conduct tailored cyberspace operations. Dedicated cyber units enable cyber professionals to command and lead these units. Placing talented cyber leaders in charge of these units will set conditions for greater capability and community growth than allowing non-cyber personnel to command.

Alternate Concept Solutions

Time is needed to grow and refine concepts. It is understandable for national and naval leaders to demand to be shown why they should invest in cyber. Yet there is a chicken-and-egg problem without the correct alignment of personnel, structures, and concepts. The Navy needs to rethink the timeline it expects to see results outside of classified spaces and what it can do to support those results. Special operations forces (SOF) are beginning to see the benefits because they have begun to invest in cyber. CWEs have already proven their potential impact with SOF at demonstrations. The impact can go beyond demonstrations, but the Navy must set conditions for it to happen.

Correctly aligning cyber communities and commands will help the Navy develop new concepts for employing maritime cyber operations. Though most cyber operations will continue to be conducted remotely, there are opportunities for conducting close-access cyber operationsthrough working with SOF or from various naval platforms. The cryptologic warfare community has had decades to develop these concepts but has failed to do so. The fewadvancements in the past decade have been led by CWEs, though naturally most are classified.

The Navy’s ability to go anywhere and maintain a significant dwell time poses a great opportunity for initial access, which is the largest obstacle to offensive operations. The Navy must embrace cyber as a domain and capability to be used against maritime targets, such as hacking enemy warships and forcing their engines to seize up or hacking foreign antiship cruise missile systems preventing them from being launched as a strike group conducts operations. Defensively, concepts for maritime cyber that must be expanded include protectingwarships from cyber attacks, decoupled and modular systems so the Navy can get rid of its Windows XP machines, and inter-ship network defenses. The Navy—and much of the government—has a scarcity mindset that regards cyber capabilities as too expensive and sensitive to ever be used. This mindset must change to empower the people tasked with developing and operating these capabilities. The Navy needs to shift its Overton window to align with the realities of cyber and embrace lower equity cyber capabilities.

Finally, the Navy must hold its civilian and uniformed cyber personnel accountable for results. It must send the message that cyber is important enough that if you fail, you will get fired.

Consequences of Inaction

If the Navy cannot prioritize cyber, then it must divest itself entirely of cyber warfare. Maintaining a mediocre cyber force is a waste, so the Navy must choose to go all-in or all-out. Divesting may force the DoD to create an independent U.S. cyber force, but that would mean the Navy would forever lack the ability to conduct maritime cyber or develop tailored cyber concepts and capabilities.

No Admiral Sims is coming to save Navy cyber. The Navy must make tough decisions to create an environment in which it can again be a top cyber player. Overhauling the responsible communities, reorganizing commands so cyber is not an after-thought, and setting conditions for refreshed concepts of maritime cyber are all critical. If the Navy does not follow this path, then it must exercise a truly drastic plan: sacrifice any opportunity to ever again be a capable cyber player and give its full support to the creation of an independent cyber service. The one thing truly unacceptable is to stay the course and accept mediocrity in cyber.

1. U.S. Navy, Navy Cyber Warfare Development Group Instruction 3120.1C, NCWDG Standard Organization and Regulations Manual (18 February 2021).

Article link: https://www.usni.org/magazines/proceedings/2022/august/navy-needs-cyber-course-correction

Lieutenant Commander Derek Bernsen, U.S. Navy

Lieutenant Commander Bernsen is a cyber warfare engineer officer who recently transferred to the U.S. Navy Reserve. He has a master’s degree in computer science from Georgia Tech and is a graduate of The Citadel.

MORE STORIES FROM THIS AUTHORVIEW BIOGRAPHY

By CHRIS RIOTTAAUGUST 1, 2022

The proposal would establish baseline safeguards for cybersecurity and physical issues like natural disasters

A group of bipartisan senators have introduced legislation to establish baseline cybersecurity requirements and new protections against catastrophic weather-related disasters for federal data centers across the country.

The Federal Data Center Enhancement Act of 2022 tasks the Office of Management and Budget with establishing standardized cybersecurity requirements for the federal facilities, which host some of the nation’s most sensitive information technology and cybersecurity infrastructure.

OMB will have 180 days to provide new minimum requirements for data centers under the legislation, which includes specific calls for information security protections and safeguards against power failures, natural disasters and intrusions. The bill also instructs OMB to work with the Cybersecurity and Infrastructure Security Agency and the National cyber director’s office to establish the requirements, as well as consult with the General Services Administration and the Federal Chief Information Officers Council.

Sen. Gary Peters (D-Mich.), chairman of the Senate Homeland Security and Governmental Affairs Committee, noted the responsibility federal data centers have to protect data like Social Security and credit card information in a statement after the bill was introduced on Friday.

“The federal government is responsible for storing considerable amounts of sensitive and personal information,” he said, adding: “We must ensure this data is stored securely and used in a way that does not violate civil rights and liberties.”

Peters introduced the bill along with Sen. Jacky Rosen (D-Nev.) and Sen. John Cornyn (R-Tex.). 

The bill seeks to build on recent efforts to close and consolidate federal data centers: over 6,000 facilities have been consolidated since 2010, a trend that has resulted in an estimated $5.8 billion in cost savings and cost avoidance, according to a copy of the bill obtained by FCW. 

Agency leaders will be tasked with regularly assessing their data center usage to help determine whether to continue operating a data center, and to ensure legacy systems are updated, modern technologies are employed and the facility is overall optimized and secure against potential vulnerabilities. 

“The sensitive information stored on federal systems cannot be left open to vulnerabilities like cyberattacks or natural disasters,” Cornyn said in a statement. “This legislation would help secure federal data and encourage optimization, which will save taxpayer dollars and protect Americans who entrust their information to the federal government.”

Rosen also noted the “increasing threat of cyberattacks and natural disasters” in a statement and said the bill “will enact a new set of security and resiliency standards” to protect data.

Article link: https://fcw.com/security/2022/08/senators-introduce-bill-ensure-resiliency-federal-data-centers/375219/

Companies already have the systems in place that are needed to evaluate their deeper impacts on the social fabric.

By Nathaniel Lubinarchive page Thomas Krendl Gilbertarchive page August 9, 2022

We all want to be able to speak our minds online—to be heard by our friends and talk (back) to our opponents. At the same time, we don’t want to be exposed to speech that is inappropriate or crosses a line. Technology companies address this conundrum by setting standards for free speech, a practice protected under federal law. They hire in-house moderators to examine individual pieces of content and remove them if posts violate predefined rules set by the platforms.

The approach clearly has problems: harassment, misinformation about topics like public health, and false descriptions of legitimate elections run rampant. But even if content moderation were implemented perfectly, it would still miss a whole host of issues that are often portrayed as moderation problems but really are not. To address those non-speech issues, we need a new strategy: treat social media companies as potential polluters of the social fabric, and directly measure and mitigate the effects their choices have on human populations. That means establishing a policy framework—perhaps through something akin to an Environmental Protection Agency or Food and Drug Administration for social media—that can be used to identify and evaluate the societal harms generated by these platforms. If those harms persist, that group could be endowed with the ability to enforce those policies. But to transcend the limitations of content moderation, such regulation would have to be motivated by clear evidence and be able to have a demonstrable impact on the problems it purports to solve.

Moderation (whether automated or human) can potentially work for what we call “acute” harms: those caused directly by individual pieces of content. But we need this new approach because there are also a host of “structural” problems—issues such as discrimination, reductions in mental health, and declining civic trust—that manifest in broad ways across the product rather than through any individual piece of content. A famous example of this kind of structural issue is Facebook’s 2012 “emotional contagion” experiment, which showed that users’ affect (their mood as measured by their behavior on the platform) shifted measurably depending on which version of the product they were exposed to. 

In the blowback that ensued after the results became public, Facebook (now Meta) ended this type of deliberate experimentation. But just because they stopped measuring such effects does not mean product decisions don’t continue to have them.

Structural problems are direct outcomes of product choices. Product managers at technology companies like Facebook, YouTube, and TikTok are incentivized to focus overwhelmingly on maximizing time and engagement on the platforms. And experimentation is still very much alive there: almost every product change is deployed to small test audiences via randomized controlled trials. To assess progress, companies implement rigorous management processes to foster their central missions (known as Objectives and Key Results, or OKRs), even using these outcomes to determine bonuses and promotions. The responsibility for addressing the consequences of product decisions is often placed on other teams that are usually downstream and have less authority to address root causes. Those teams are generally capable of responding to acute harms—but often cannot address problems caused by the products themselves.

With attention and focus, this same product development structure could be turned to the question of societal harms. Consider Frances Haugen’s congressional testimony last year, along with media revelations about Facebook’s alleged impact on the mental health of teens. Facebook responded to criticism by explaining that it had studied whether teens felt that the product had a negative effect on their mental health and whether that perception caused them to use the product less, and not whether the product actually had a detrimental effect. While the response may have addressed that particular controversy, it illustrated that a study aiming directly at the question of mental health—rather than its impact on user engagement—would not be a big stretch.

Article link: https://www.technologyreview.com/2022/08/09/1057171/social-media-polluting-society-moderation-alone-wont-fix-the-problem/

August 02, 2022by John R. Fischer , Senior Reporter

Following its $28 billion acquisition of Cerner, Oracle has renamed the EHR business, Oracle Health, and has redesigned its organizational structure with several leadership changes.

David Feinberg, who served as Cerner president and CEO, will now be chair of Oracle Health, according to an internal email shared by an Oracle executive on Reddit. “David has played a pivotal role in stewarding Cerner through the acquisition, and I am excited to leverage his knowledge and connections with the healthcare community,” wrote Mike Sicilia, executive vice president of Oracle’s global business units. 

Travis Dalton, who was Cerner’s chief client and services officer, will take over as general manager for Oracle Health GIU. Dalton joined Cerner in 2001 and has held several senior leadership positions in finance, sales and consulting. In his new role, he will oversee Oracle Health’s worldwide go-to-market teams, including marketing, sales, service, global operations and the health office. 

Oracle executive vice president Don Johnson will now manage Oracle Health engineering, with former Cerner chief technology officer Jerome Labat and other tech executives reporting to him. “This structure will give the Oracle Health engineering team many more technical resources and capabilities to accelerate our industry transformation,” wrote Sicilia. 

The company is also combining its IT, finance, legal, HR and other corporate divisions into centralized, global teams. 

Oracle acquired Cerner in June 2022 in an all-cash deal. It is its largest acquisition to date and provides access to Cerner’s EHR systems, as well as a stake in the provider- and patient-facing clinical systems market. 

The company will modernize Cerner’s solutions by integrating its Autonomous Database, APEX low-code development tools and voice-enabled user interface. It also is moving them into its Gen2 Cloud platform to aid treatment decision-making and reduce IT infrastructure costs.  

Additionally, Oracle plans to create a nationalized database that pulls information from thousands of EHRs in hospitals across the U.S. This will solve interoperability problems, create faster access to records and enable development of diagnostic AI models, according to Oracle chairman Larry Ellison.  

“Better information will allow doctors to deliver better patient outcomes. Better information will allow public health officials to develop much better public health policy and it will fundamentally lower healthcare costs overall,” said Ellison in a virtual briefing.

Article link: https://www-dotmed-com.cdn.ampproject.org/c/s/www.dotmed.com/news/amp/2022-08-02/Oracle-Renames-Ehr-Business-Restructures-Leadership-Following-Cerner/58512

FORT BRAGG, N.C. — Soldiers from the XVIII Airborne Corps and 82nd Airborne Division are leading the U.S. Army’s transition to data-centric operations as they use new technologies to counter evolving threats.

Leveraging Army Vantage, the Army’s enterprise data decision platform that connects to and draws data from new and legacy systems in any form at any scale, deployed units are configuring end-to-end operational applications to streamline the outload of forces, automate logistics status reporting, capture new unstructured data and make real-time, intelligent decisions.

Commanders and staff are often dependent upon a myriad of disconnected joint, service level and combatant command data sources that, on their own, are unable to provide a single operational picture to commanders. In addition, these systems do not inform echelons below corps, and they lack the flexibility and adaptability to accommodate rapidly changing priorities and requirements on the ground.

Soldiers are now able to bring modern technology to bear against legacy systems to solve the critical knowledge gaps for commanders in stride with Army Vantage,

“Our efforts on [Army] Vantage connected dozens of standalone systems and removed swivel chair operations to streamline our deployment process, ensuring we hit the ground running,” said XVIII Chief Technology Officer Jared Summers.

Traditionally, deployments have been tracked with small pieces of information that inform outload operations, siloed across tens of disconnected — and sometimes outdated — systems. These different systems didn’t provide the full picture of the outload process making it cumbersome to stitch together segments of the common operating picture to produce up-to-date data.

As a result of this process, Soldiers in January and February resorted to phone calls and emails to track the movement of critical units. This meant deploying units manually entering data into Excel spreadsheets and PowerPoint slide decks to track the most up-to-date Unit Movement Plans. This manual process consumed hundreds of staff hours entering, formatting, and validating that data. The ever-changing data made even the most updated Excel spreadsheet or PowerPoint turned stale before the information was distributed across formations.

On recent deployments, the 82nd Airborne Division faced new challenges with seeing ground truth. Units were tasked to capture data from new sources at the edge — including data from partner nations — to inform operational decisions. No system existed for this type of mission, but the Soldiers of America’s Contingency Corps were able to solve this problem in days using Army Vantage as a starting point.

“[Army] Vantage became a game changer for us during our last deployment,” said XVIII Chief Data Officer Jock Padgett. “With the centralized and well-connected data operations platform, we enabled warfighters from the edge to Joint Staff with new, rapidly built end-to-end data pipelines, decision making modules and meaningful dashboards.”

The advantage of Army Vantage’s no-code application builder allowed Paratroopers from the 82nd Airborne Division to configure a transportation management tool to integrate real-time updates from tactical edge devices and enabled Soldiers to track and execute logistical tasks from a single, connected mission command environment.

Within a week, the 82nd Airborne Division transitioned from antiquated Excel spreadsheets reporting to a fully functioning application built in Army Vantage.

“The speed at which engineers and citizen data scientists can build products for operational users is exponentially faster on [Army] Vantage,” said Padgett. “Previously, we would spend the majority of time trying to get systems accredited or trying to gain access and integrate data. Now, we can actually fight with that data.”

At the XVIII Airborne Corps headquarters, Soldiers with Project Ridgway, the corps’ AI-driven initiative, and the newly established Data Warfare Company help configure applications within Army Vantage to track real-time equipment supply levels in theater.

“Leveraging the [Army] Vantage platform, we were able to rapidly create workflows ensuring we had up-to-date status of all classes of supply,” said Summers. “We were also able to leverage the analytic and monitoring tools on Vantage to compare expected to actual usage rates and set parameters or alerts when a certain class of supply was running low.”

“Our goal is to transform our logistics operations from a pull to a push-based system,” he added. “Just as with just-in-time logistics, we will know what is needed, when its needed and where to ensure a secure supply chain.”

Army data platforms should enable units to build for the unexpected, adapt to changing conditions and aggregate new battlespace information for which collection was not anticipated prior to — and during — the onset of a contingency.

Army Vantage’s flexible no-code, app-building tools and user-configured data capture forms are empowering America’s Contingency Corps to do just that. By having the tools to rapidly and seamlessly combine curated data from multiple source systems with enhanced insights captured from those on the front lines, units can create a digital twin that replicates the world in its truest state.

With an established application interface layer, Army Vantage provides this novel data asset to warfighting and logistics systems, powering a cohesive decision environment and enabling the XVIII Airborne Corps’ effort to see the battlespace in a single pane of glass.

“We’re continuing to grow the data integrations across [Army] Vantage, asking new, novel questions related to operations, logistics, personnel, and intelligence data. [Army] Vantage has tremendously advanced the Army’s Single Pane of Glass initiative,” said Padgett. “We’re making progress.”

Article link: https://www.army.mil/article-amp/258912/reinventing_modern_deployment_soldiers_leverage_army_vantage_to_make_data_driven_decisions

By ALEXANDRA KELLEYJULY 25, 2022

The new VA Profile system is a back-end data storage program that will give agency offices and systems a single source for accurate veteran information.

The Department of Veterans Affairs aims to further streamline and share critical information about its veterans with a new Master Data Management system, a back-end system that prioritizes taking accurate data elements and distributing them across VA entities, becoming a centralized backbone data system for the agency. 

Previously announced in the Federal Register, the VA Profile platform communicates with preexisting VA application programming interfaces and allows them to access an expansive amount of veteran data, such as contact information and benefits eligibility, deploying it across agency offices and internal records.

The software will gather this information from other agency data sources to help power everyday VA business operations, especially facilitating services between VA officials and veterans.

Speaking with Nextgov, James Whited, the director of customer master data and APIs within the data analytics product line in the VA’s Office of Information and Technology, explained that the new VA Profile will leverage authoritative data sources from multiple systems within the VA and create a master record. 

“VA Profile is really trying to provide a single source of truth for common and shared data for the veteran…throughout the VA into VA systems,” Whited said.

He added that the key innovative component of the VA Profile is how it summons and connects diverse data sources to officials across the VA. It also aims to help employees find critical data easily while working. 

“VA Profile, you can think of it…like, behind the scenes wiring between those systems,” Whited said. “We want to provide that data to you quickly, easily with a modern technology stack and modern interface, so that you can quickly move on to doing what’s really going to drive and provide value to the veteran and help VA employees efficiently do their jobs.”

Initially, the VA Profile only gathered veteran contact information, later expanding to include benefit eligibility, military service and demographic data.  

This data already exists in VA datasets, but is now consolidated in the VA Profile as a master veteran profile. With existing data now streamlined and located in one platform, Whited said that VA employees will be able to do their jobs more efficiently by not having to hunt data across agency systems. 

“VA Profile is simply the mechanism that’s going to give you that data, provide that access point,” he said. Conversely, having key veteran information stored in one digital location also helps veterans themselves easily access and update their information through interfaces like va.gov.

Once augmented, data stored within the VA Profile will be distributed across many other systems at the VA—though not all. Whited confirmed that VA Profile will interact with the embattled electronic health record system, distributing relevant, updated veteran data into an EHR. 

Whited said his office plans on adding more data into VA Profiles, including key indicators like veteran interactions with VA call center agents. 

Editor’s note: This story was updated to clarify the description of VA Profile.

Article link: https://www.nextgov.com/analytics-data/2022/07/vas-new-master-record-aims-be-single-source-truth-veteran-data/374878/

GAO issues a warning as Congress struggles to reach fiscal 2023 spending agreement.

ERIC KATZ | AUGUST 3, 2022 05:28 PM ET

With lawmakers already cautioning of the potential need for a stopgap funding bill to avoid a shutdown in October, the government’s top watchdog has issued a warning of its own on the damage caused by those short-term measures. 

Continuing resolutions, the temporary spending bills Congress has passed in all but three of the last 46 years, have wide-ranging impacts on agency operations, including their ability to bring in new employees. Agencies often limit or pause entirely hiring while CRs are in effect, as they have been in 47 different instances since 2010. 

The Government Accountability Office based its findings primarily on discussions with three program offices across government. Officials at the departments of Agriculture, Education, and Health and Human Services said CRs led to “administrative inefficiencies and limited management options,” including preparations they must take for a potential shutdown, reduced travel funds and a diminished ability to plan at all. They also noted the process hurts their hiring capacities, as some agencies do not extend new hire offers during a CR. That can hinder strategic plans and delivery of services, officials said.

Agencies reported an inability to finalize contracts and grant awards. Education’s Predominantly Black Institutions program, for example, delays its award notices during CRs, which in turn causes recipient schools to postpone decisions about how to spend potential funds. At HHS’ Low Income Home Energy Assistance Program, CRs cause disruptions for grantees providing assistance at different rates throughout the year due to seasonal changes. The stopgap bills cause administrative burdens for agencies, such as having to regularly update their allocation formulas to adjust for amounts doled out in the various spending measures. Agencies and grantees also said they have to take special efforts to get money out the door in a more concentrated timeframe when Congress only provides full-year appropriations late into the year. 

Despite those obstacles, GAO found the agencies continued to provide services without major disruptions. Officials said they relied on previous experience with CRs and how to prioritize resources, including a familiarity among program office staff with adjusting allocations throughout the year. They have also offset potential disruptions by using authorities to repurpose funding that Congress originally provided for another purpose.

Lawmakers can also provide “anomalies” as part of CRs, as they have done in 690 instances since 2010. Those provisions give agencies a different, specific amount of money than they would normally receive or extend authorities otherwise set to expire. Requests for those anomalies come from the Office of Management and Budget, which typically asks agencies to send over their potential needs in early July of each year. In recent years, lawmakers have included around a dozen anomalies in each CR. In rare instances, agencies can receive multi-year appropriations that also offset the impact of stopgap funding bills. 

Democrats and Republicans remain significantly divided as they approach the expiration of current funding. Democrats in the House and Senate have put forward separate bills for each of the 12 annual measures Congress must pass each year, doing so without any Republican support. The two sides have yet to agree on top-line funding levels for defense and non-defense spending, or the specific allocations for the 12 bills. Sen. Richard Shelby, R-Ala., the top Republican on the Senate Appropriations Committee, denounced the Democratic bills, saying they marked a step backward toward a possible resolution. He criticized Democrats for including “poison pill” provisions and for failing to include a sufficient increase for military spending.

“Democrats know the path to a successful appropriations process, but today they chose to move in a different direction,” Shelby said. “Today’s effort shows we have a long way to go. Democrats need to get serious or, regrettably, I believe we will end up with a long-term CR.”

Sen. Patrick Leahy, D-Vt., who chairs the committee, said historically high rates of inflation would make a long-term continuing resolution to keep agencies funded at their current levels “untenable” and called on Republicans to resume negotiations “with the urgency that this moment requires.”

Article link: https://www.govexec.com/management/2022/08/agencies-are-struggling-hire-and-spend-money-due-incessant-stopgap-funding-bills/375348/

https://youtu.be/v16XW1ufK0w

By EDWARD GRAHAMAUGUST 3, 2022 04:54 PM ET

The selection of Dr. David Massaro to the senior role fills out the leadership team of the VA office tasked with “processing and resolving patient care concerns” related to the agency’s new electronic health record system

The Department of Veterans Affairs this week appointed Dr. David Massaro as the functional champion for the agency’s Electronic Health Record Modernization Integration Office, which is tasked with implementing and deploying the VA’s new Oracle-Cerner Millennium electronic health record system. 

The selection of Massaro “completes the Office of the Functional Champion leadership team,” according to an email to staff from recently-confirmed VA Undersecretary for Health Dr. Shereef Elnahal that was obtained by Nextgov. 

As part of an updated EHR implementation plan announced in December 2021, VA empowered the OFC to have a more direct role in bridging gaps between the IT team, Oracle-Cerner and patient delivery teams, as well as “having a principal role in processing and resolving patient safety concerns.”

As the functional champion, Massaro will represent the Veterans Health Administration as its clinical executive and lead “functional initiatives to support VA’s medical personnel,” according to the VA’s website. This work includes coordinating the ongoing development and implementation of the VA’s multi-billion EHR system, which has been hampered by cost overruns, technical issues that have affected patient care, and software outages. 

The VA announced last month that it was postponing planned deployments of the new system at medical sites until January 2023 to address ongoing concerns about the Oracle-Cerner software’s rollout. The decision to delay future deployments came after a highly critical report from the VA’s Office of Inspector General found that the software implemented at the first site of the EHR system rollout—the Mann-Grandstaff VA Medical Center in Spokane, Washington—contained a serious flaw that improperly routed over 11,000 clinical orders for veterans to an “unknown queue” without alerting clinicians.

That watchdog report, along with a recent cost estimate from the Institute for Defense Analyses—which found that the Oracle-Cerner system would cost $50.8 billion over 28 years in implementation and maintenance expenses—has led some lawmakers to consider “pulling the plug” on the new EHR system. 

Dr. Terry Adirim, program executive director for the VA’s EHRM Integration Office, said in a statement that Massaro “was selected due to his commitment to deploying an electronic health record that enables VHA to function as a High Reliability Organization and Learning Health System that places the veteran first.”

Prior to assuming the role of functional champion on Aug. 1, Massaro served as the acting chief health informatics officer for the Office of Community Care within the VHA’s Office of Health Informatics. He began working for the VA in 2006 at the Aleda E. Lutz VA Medical Center in Saginaw, Michigan, and has also served as a VHA physician executive across the agency’s healthcare systems.

Article link: https://www.nextgov.com/technology-news/2022/08/va-appoints-functional-champion-help-streamline-embattled-ehr-rollout/375351/