healthcarereimagined

By Jaspreet Gill on July 13, 2022 at 3:34 PM

WASHINGTON: The Air Force needs a strategy to get more out of its investments in its different “raindrops” of software factories, according to a former Pentagon official who said he also fears the service isn’t growing enough talent in those initiatives.

Ed Wilson, former deputy principal cyber advisor to the secretary of defense, said though he’s a “big fan” of the “software factories for DevSecOps,” and sees their continued growth, he questioned how the service could “gain a bit more efficiency at times.” DevSecOps refers to an approach that combines software development, cyber security and software operations.

“I’m not…for more bureaucracy, but we kind of have raindrops of software factories out there,” Wilson said at the America’s Future Space Innovation Summit on Tuesday. “Not all are created equal. There’s more success stories than others.”

He added his “fear would be we’re not growing enough talent that can be successful in those environments. And so I think we need to pay attention to that talent pool for the DevSecOps.”

The Air Force has a number of software factories tasked with developing and delivering new software spread throughout the country, including space-specific innovation hubs and platformONE, the Defense Department’s DevSecOps environment. In total, 29 software factories exist today across the military services.

Wilson’s comments appear echo some concerns that were addressed in a Pentagon-wide software modernization strategy released Feb. 2. That strategy called for harnessing all 29 factories and establishing an enterprise-level “ecosystem” in a move to more rapidly acquire and deliver software at speed.

RELATED: The Pentagon wants to turn its 29 software factories into one ‘ecosystem’

The goal of the modernization strategy is to have a centralized software hub that would help streamline control points for end-to-end software delivery and speed innovation into soldiers’ hands. It also warned that current DoD processes governing the way the department buys, implements and operates across missions can’t keep up with the changing pace of technology.

To Wilson’s comments about not growing enough talent, a major objective in the strategy calls for “advancing technical competencies,” or improving the workforce.

DoD wants to establish a “standard and dynamic inventory of baseline training and augment that training with investments in cross-Service, on-the-job apprenticeship programs and rotation opportunities,” according to the strategy.

Jason Weiss, DoD’s chief software officer, told reporters in February that the Pentagon had also created a task force under the Software Modernization Steering Group to recommend best practices and policy changes for the factories.

“We’re seeing lots of lessons learned start to percolate to the top and a lot of collaboration taking place through things like our DevSecOps community of practice,” Weiss said. “So it is a living and breathing ecosystem. And we are going to be looking at and listening to those software factories to determine what policy changes to prioritize and when to affect them.”

Article link: https://breakingdefense-com.cdn.ampproject.org/c/s/breakingdefense.com/2022/07/air-force-needs-more-efficiency-from-raindrop-software-factories-former-dod-cyber-official/amp/

The Biden administration has already hosted expansive summits on ransomware and open-source software security. Now it’s taking a similar approach in an attempt to tackle problems in the cybersecurity workforce.

On Tuesday, the White House will bring experts, private sector companies and federal agencies together to brainstorm around one of the most pressing challenges in cybersecurity: people or, more accurately, the lack of them.

The meeting will be led by National Cyber Director Chris Inglis and includes leadership from the Departments of Homeland Security, Commerce and Labor, as well as Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency; Anne Neuberger, White House deputy national security advisor for cyber and emerging technology; Susan Rice, director of the Domestic Policy Council; and James Kvaal, undersecretary of education.

While the total number varies depending on the source, most estimates peg the shortage of qualified cybersecurity workers in the hundreds of thousands. CyberSeek, a non-profit organization backed by the National Institute for Cybersecurity Education that maps job openings, currently flags more than 714,000 open or unfilled cybersecurity positions around the country. It’s a problem that impacts both governments and businesses alike and is happening as both sectors are attempting to coalesce around ambitious long-term plans to increase the resiliency of systems and data against nation-state and criminal hackers alike.

“With approximately 700,000 cybersecurity positions open, America faces a national security challenge that must be tackled aggressive. During the summit, participants will help chart a path toward a more secure future in which all Americans have the opportunity to raise the bar on cybersecurity through greater awareness, education, and training,” the White House said in the announcement. “The summit will also serve as a call to action — to ensure that all Americans can capitalize on the benefits of the digital domain and to ensure that our nation carries through on the positive opportunities ahead of us.”

A snapshot of open cybersecurity jobs around the country. (Source: CyberSeek)

They will be joined by executives from the private sector and experts from academia and the cyber community, though the White House says more announcements on that front are forthcoming. Thus far, SC Media has confirmed that Barbara Massa, executive vice president of business operations at Mandiant, will be in attendance, as will Heather Adkins, vice president of security engineering at Google. A Microsoft spokesperson declined to comment and directed SC Media to the White House.

The summit will focus on three core challenges that have kept the supply of cybersecurity talent from keeping up with demand. One is finding a way to better utilize trade schools, apprenticeships, community colleges and other non-traditional educational institutions to create new skill-based pathways into a cybersecurity career. Another will look at tapping into underserved and diverse communities, including women and people of color, who have long been underrepresented in the field and industry leaders are working to make the field more welcoming to other backgrounds.

Finally, the meeting will look at how to invest wisely in educational initiatives to ensure American workers are trained to succeed and stay secure in a digital economy, regardless of whether they work directly in cybersecurity or other fields. While more cyber practitioners are badly needed, a massive part of any organization’s attack surface comes from the actions and decisions of their non-cyber employees, who can often upend millions of dollars in security spending by clicking on a malicious link.

As Inglis put it earlier this year when discussing the need for fundamental skills up and down the workforce: “We don’t necessarily need to make [everyone] a python programmer —  but that we make them cyber aware.”

Boosting the national cyber workforce has been a long-held goal for the Biden administration as well as its predecessor, the Trump administration. There are few, if any, straightforward solutions to the problem, at least in the short-term. More and more of our national infrastructure is being put under the control or direction of potentially vulnerable software, or connected to the internet, where it’s within reach for state-backed or criminal hacking groups. But the often highly technical work needed to secure those systems is being carried out by an increasingly smaller proportion of the workforce.

There is no easy method to quickly teach or acclimate new workers the fundamentals of cybersecurity or the IT and networking principles that underpin them. That means that even as companies and agencies are desperate to fill open roles, they’re often not willing to put the security of their organization or its customers in the hands of a novice.

Some have questioned whether untrained or undertrained cybersecurity workers would ultimately be a net boon or drag on companies remains an active debate.

Jake Williams, a former hacker at the National Security Agency and current executive director of threat intelligence at Scythe, has argued that putting untrained or lightly trained cybersecurity workers on the job is irresponsible and wouldn’t be accepted in other fields where safety and competence are considered core priorities.

“Your airline pilot started in a single engine Cessna. Nobody called it gatekeeping. And before that, they learned lots of ‘mostly irrelevant’ facts in ground training,” Williams remarked last week on Twitter. “Cyber is one of the only fields where we pretend that skipping the basics is okay to put butts in seats.”

In an email, Williams told SC Media he thinks the government and military actually do a very good job of recruiting and training cyber employees but “for the commercial workforce, the situation is a bit more bleak.” That’s in part due to what Williams, who is also a senior instructor in digital forensics at the SANS Institute, characterized as the poor state of many commercial cybersecurity training programs that churn out degrees without ensuring that graduates are being properly schooled on the fundamentals of IT security that they require before they can be trusted with protecting an organization’s sensitive data.

“Those trying to break into the cybersecurity field, often lament that employers need to ‘be realistic about skills’ and ‘take a chance on someone with passion to learn.’ The unfortunate reality is that [small and medium-sized businesses], many of which are making their first security hire, simply cannot afford to hire people without a broader cross section of security knowledge and/or experience. This leaves a disconnect between expectations and reality for many cybersecurity bootcamp graduates.

Others have called for the country to respond with a mass mobilization effort to train a generation of cybersecurity workers and put them in a position to gain experience as they work. James Lewis, senior vice president and director of the strategic technologies program at the Center for Strategic and International Studies, said last month that the U.S. is not “serious” about solving the cyber workforce shortage and won’t get anywhere near closing the gap by relying on slower, more traditional means of education or training.

He drew a comparison to efforts by the U.S. military during World War II to train an entire generation of pilots to compete with Germany, Japan and others for dominance of the skies. There is no initiative on the part of policymakers to do something similar with cybersecurity, while shortages and competition with the private sector for qualified workers only continues to grow.

“You need to create a pipeline, you need to put untrained bodies at the front, and you need to have pilots come out the other end, and you need to do that at scale and we’re not doing that,” Lewis said.

Article link: https://www.scmagazine.com/editorial/analysis/careers/white-house-to-hold-summit-on-addressing-the-thousands-of-unfilled-cybersecurity-jobs?

By NATALIE ALMSJULY 12, 2022

Workforce, interoperability and governance all feature in the new goals set for the President’s Management Agenda.

The White House filled in some of the blanks on the President’s Management Agenda last Friday with an update on flexing federal procurement muscles to advance administration priorities like addressing climate change. 

“We can harness this collective power and make connections across the federal acquisition and financial assistance systems to strengthen the U.S. manufacturing base and support American workers, catalyze new solutions that address the climate crisis and enhance sustainability, and advance equity,” the document states.

The government oversees over $1.5 trillion in federal contracts and financial assistance annually, according to performance.gov.

One goal is to “create a diverse and resilient federal marketplace.” The administration has already set goals around increasing the number of awards given to small, disadvantaged businesses generally and minority-owned small disadvantaged businesses specifically.

The Office of Management and Budget also pins down interoperability and sharing of acquisition data and tools as a second goal, and building an “inspired, engaged acquisition workforce” as a third goal for procurement and acquisition.

An OMB spokesperson told FCW that acquisition workforce improvements could involve modernizing training and development, and pursuing pilots meant to “support user-friendly access to information to support decision-making by the Federal acquisition workforce.”

The second half of the “business of government” priority focuses on federal financial management, where the administration says it wants to further improve processes and “build capacity.”

The PMA website points to lessons learned from implementing the American Rescue Plan Act and the bipartisan Infrastructure Investment and Jobs Act as evidence that the time is ripe to make progress in managing government business on an enterprise level, as well as an “increasing federal focus on program and payment integrity.”

Success metrics and milestones for this area of the PMA – something the other two priorities of workforce and customer experience already have – will be published in the next update to performance.gov, according to a blog post accompanying the latest update.

Article link: https://www.nextgov.com/cxo-briefing/2022/07/white-house-updates-acquisition-business-government-priorities/374111/

July 12, 2022

Europe’s new Digital Services Act opens a new era in access to justice for disinformation and online hate. Americans should take a close look.

When victims face disinformation or online hate speech today, they enjoy little hope of redress. They are more likely to try to look away – closing their browser windows or leaving online spaces altogether – than to seek justice. Even when faced with illegal content such as defamation or harassment – situations in which legal grounds to go to court exist – few possess the financial or emotional resources to hire a lawyer and put pressure on a powerful platform. 

Europe’s Digital Services Act (DSA) changes this equation.  

It represents the first sustained attempt to modernize rules for online content in a democratic and rule-of-law environment. While preserving free speech, the DSA reinforces access to justice in content moderation decisions, imposing on platforms a variety of scaffolded transparency and accountability requirements.   

Among other changes, platforms must open an “internal complaint handling system” where users can submit complaints about content moderation decisions, both in cases of over-moderation (take downs) and under-moderation (when platforms decide not to act on reported content). When complaints contain sufficient grounds, the platform will need to reverse its decision.  

While many platforms already have procedures for reporting content and appealing content moderation decisions, their formulation, scope, and accountability vary, and our research shows that all have ample room for improvement. Disinformation and hate speech proliferate, while it is prohibitively challenging for people to appeal wrongful content moderation decisions.  

Consider LGBTQ+ hate. In their most recent report on ‘LGBTI-phobies’, the French NGO SOS Homophobie found once again that online environments remain the most prevalent spaces for anti-LGBTQ+ sentiment. At the same time, the NGO notes a decline in reporting, which they attribute to victims and witnesses’ frustrations with effective moderation and insufficient resources devoted to answering their complaints. 

Content moderation is particularly lacking in languages other than English. During her testimony before the US Congress, Facebook whistle-blower Frances Haugen revealed that 87% of misinformation spending by Facebook is on English-language content, but only about 9% of their users are English speakers. Even globally spoken languages like Spanish are neglected. In March 2021, a coalition of organizations launched the campaign #YaBastaFacebookcalling for better Facebook protection of Spanish-speakers. 

Facebook isn’t alone. Spanish YouTube and TikTok influencer Naim Darrechi claimed recently in a viral video that he had legally become a woman by filling out a simple form and that he could change sex to increase his welfare payments every six months. This is false: Spanish law offers no such right. Even now, this misogynistic and transphobic disinformation remains available online. 

In such cases – or when initial reporting and appeals processes fail –the DSA will provide the option of “out-of-court dispute settlement.” Independent bodies in different European countries will be established to deal with content moderation disputes. This option will be especially useful for dealing with ‘lawful but awful’ content such as LGBTQ+ hate, much of which would not have grounds to be brought to court under national laws. At the same time, the independent bodies’ decision will not be legally binding, so the justice system can still have the final say.

Another DSA innovation allows representation. Specialized organizations will be able to exercise the rights of individuals under the DSA on their behalf. This will be critical since victims and witnesses of hateful content may be hesitant to appeal content moderation decisions given the emotional or traumatic engagement they have suffered. 

The DSA is not just about Europe. It’s reasonable to expect that it will raise the bar globally: once a platform improves redress mechanisms in Europe, it would be logical to harmonize these policies and implement them for all their users. 

The DSA is set to enter into force in 2024 for all online platforms. It will come into force even earlier for so-called Very Large Online Platforms, those with more than 45 million European users. This gives platforms plenty of time to design and implement accessible, intuitive appeals systems – and to begin offering Europeans real access to justice online.

Article link: https://cepa.org/the-eus-rights-based-approach-against-disinformation/

Claire Pershan is Policy Coordinator for EU DisinfoLab, an independent non-profit organization focused on tackling disinformation.

by Todd C. Helmus

Related Topics:

Artificial Intelligence,

Data Analysis,

The Internet,

Media Literacy,

Social Media Analysis

DOWNLOAD FREE ELECTRONIC DOCUMENT

PDF file 2.4 MBTechnical Details »

The purpose of this Perspective is to provide policymakers an overview of the deepfake threat. It first reviews the technology undergirding deepfakes and associated artificial intelligence (AI)–driven technologies that provide the foundation for deepfake videos, voice cloning, deepfake images, and generative text. It highlights the threats deepfakes pose, as well as factors that could mitigate such threats. The paper then reviews the ongoing efforts to detect and counter deepfakes and concludes with an overview of recommendations for policymakers. This Perspective is based on a review of published literature on deepfake- and AI-disinformation technologies. Moreover, leading experts in the disinformation field contributed valuable insights that helped shape the work.

Article link: https://www.rand.org/pubs/perspectives/PEA1043-1.html

By PATIENCE WAITJULY 15, 2022

But it’s not yet open warfare.

During the four years between the 2016 and 2020 presidential elections, many cyber experts and pundits were concerned that Russia or other nation-states would evolve their ability to manipulate U.S. voter perceptions by migrating from social media memes to deepfakes. That emerging technology can be used by employing computer-altered images and video footage to denigrate candidates in some way, hurting their chances at the polls.

The RAND Corporation has released a new report, “Artificial Intelligence, Deepfakes, and Disinformation: A Primer,” that concludes “the potential for havoc is yet to be realized. For example, some commentators expressed confidence that the 2020 election would be targeted and potentially upended by a deepfake video. Although the deepfakes did not come, that does not eliminate the risk for future elections.”

The report identifies several reasons why deepfakes have not yet lived up to their threatening reputation, in particular that “well-crafted deepfakes require high-end computing resources, time, money and skill.”

Matthew Stamm, Ph.D., associate professor of electrical and computer engineering at Drexel University, has been working in the field of detecting fake media for about 15 years, and has contributed to the Defense Advanced Research Projects Agency’s programs on detection algorithms. He agrees that making outstanding deepfakes is not easy or cheap, but isn’t sure how much that matters in regard to their effectiveness.

“Over time [they] will improve,” he says. “But we also have to contend with another factor—we are predisposed to believe something that confirms our prior beliefs.”

Stamm cites as an example the doctored Nancy Pelosi video that ran rampant over social media during the summer of 2020, which made it appear that her speech was slurred—Speaker Pelosi is a teetotaler. It was not a sophisticated deepfake, he says—and he helped debunk it. The sound was just slowed down a little bit to make it seem as if she was impaired. But no matter how often it’s disproved by fact checkers or flagged by social media, plenty of people accept it as “fact.”

“You can often get the same result by using ‘cheapfakes,’ Stamm said. “You have to think about what’s your goal? You can spend a lot of time and money to create a very good deepfake that will last a long time, but is that your goal?”

While videos have, to date, garnered the most attention, the RAND report identifies other types of deepfakes that are easier to execute and have already shown their potential to cause harm. Voice cloning is one technique.

“In one example, the CEO of a UK-based energy firm reported receiving a phone call from someone who sounded like his boss at a parent company. At the instruction of the voice on the phone, which was allegedly the output of voice-cloning software, the CEO executed a wire transfer of €220,000—approximately $243,000—to the bank account of a Hungarian supplier.”

Another technique is creating deepfake images—the headshots that people use everywhere on social media. The report outlines the case of such an image placed on LinkedIn, “one that was part of a state-run espionage operation.” The deepfake was discovered in 2019, where it “was connected to a small but influential network of accounts, which included an official in the Trump administration who was in office at the time of the incident.”

The value of creating such deepfake images is that they aren’t detected by a reverse image search that looks for matches to original, verified images, the report observes.

The fourth form of deepfake identified in the report is generative text—using natural language computer models and AI to generate fake, but human-like, text. This would be valuable for operating social media bot networks that would not need human operators to create content. It also could be used to mass-produce fake news stories that would flood social media networks.

The report lists four key ways that deepfakes can be weaponized by adversaries or bad actors—manipulating elections; exacerbating social divisions; weakening trust in government institutions and authorities; and undermining journalism and other trustworthy information sources.

“These are large-scale social threats, but others are economic,” Stamm notes. “There have already been [cases] of audio deepfakes. There are a lot of highly criminal opportunities,” any of these deepfake methods could be used for.

The report identifies several approaches to mitigate the threat that deepfakes of all kinds pose to information integrity: detection, provenance, regulatory initiatives, open-source intelligence techniques, journalistic approaches and citizen media literacy.

Detection often gets the most attention, because most detection efforts are aimed at automated tools. DARPA has invested heavily in this area, first with its Media Forensics program that ended in 2021, and currently with its Semantic Forensics program.

But this is where the parallels to other kinds of escalation most apply. Think of the battle in cybersecurity to try to ever get ahead of hostile actors.

“Although detection capabilities have significantly improved over the past several years, so has the development of deepfake videos. The result is an arms race, which is decidedly in favor of those creating the deepfake content,” the report states. “One challenge is that as AI programs learn the critical cues associated with deepfake video content, those lessons are quickly absorbed into the creation of new deepfake content.”

Provenance is already being used in some ways. If you have ever noticed a small “i” enclosed in a circle on an image, it means the photographer used a secure mode on their smartphone to take the picture, which embeds critical information into the digital image’s metadata. “Although this technology is not a panacea for deepfakes, it does provide a way for the viewers of a photograph (or a video or recording) to gain confidence that an image has not been synthetically altered,” the report observes, but “the technology only works if it is enabled at the time the photo is taken, so promoting effective adoption of the technology will be critical.”

Stamm suggests that the Department of Defense and the Intelligence Community should consider wargaming different scenarios that could be brought about by successful deepfakes. The report suggests the same thing, recommending that government “conduct wargames and identify deterrence strategies that could influence the decision-making of foreign adversaries.”

“Dealing with fake information is one of the big challenges of the 21st century,” Stamm says. “In the 20th century it was cryptography, but now we live in a world where information sources are decentralized … We may not trust, but we still need to consume.”

Article link: https://www.nextgov.com/emerging-tech/2022/07/deepfake-arms-race-heating/374536/

Uncle Sam Isn’t a Trustworthy Dude: So What is America To Do?

By ALAN P. BALUTISJULY 15, 2022 12:05 PM ET

n a June 9 column in the Washington Post, longtime federal Insider Joe Davidson put it plainly: Uncle Sam isn’t a trustworthy dude. The column appeared just about a week before the country marked the 50th anniversary of the Watergate break-in, a scandal that forced the resignation of a president, that is taught in schools and universities—even in Florida and Texas, at least for now—that affected our politics and our governmental system and that shaped citizen attitudes towards government ever since. Watergate represented a demarcation in the nation’s history—between a time in which citizens trusted their government and a period in which trust was broken. And it has yet to be restored. Davidson’s column focused on a report from the Pew Research Center released that week in early June.

That report features a chart that tracks the decline of trust between citizens and government. The graphic begins in 1958, near the end of the Eisenhower administration—Eisenhower’s vice president was Richard Nixon. Then, 73% of Americans and majorities from both parties said they trusted the government to do what is right “just about always” or “most of the time.” Trust peaked at 77% in 1964, shortly after Lyndon Johnson ascended to the presidency, after the assassination of John Kennedy.

And then Johnson declined to run in 1968, the Fall of Saigon ended the Vietnam War in 1975, both Martin Luther King and Robert Kennedy were assassinated in 1968, Watergate occured in 1972 and Nixon was impeached and then resigned in 1974.

By the end of that year, after Nixon had flown off to exile in San Clemente, California, just 36% of Americans said they trusted their government. The recent report released by Pew showed that public trust has fallen to a “disturbing” and “near historic low” of just 20%.

Alarms have sounded from multiple good government groups and leaders concerned about this decline. Trust in government is higher not only when government works better, but also when people have a better understanding of what government is doing, according to Teresa Gerton, President of the National Academy of Public Administration. President Biden’s Management Agendaaddresses the trust issue in its focus on improving citizen services as well as government performance.

Max Stier, CEO of the Partnership for Public Service, believes the negative slide in trust can be turned around if the government communicates better and promotes its successes and “the great work of career civil servants,” according to Davidson’s column.

Former OMB official and now Grant-Thornton executive, Robert Shea, pointed to evidence-based policymaking as a key factor in rebuilding trust, when speaking with the Technology Policy Institute.

For Rajiv Desai of 3Di, writing in Route Fifty, the key ingredients are transparency, efficiency and accountability, orTEA. His argument resonated with me because it contained an acronym, which we all know is at the heart of the work of government. So who is right? Or are they all right? If only some are, what should be done to rebuild and restore? Let’s explore the topic a bit more.

On July 5th, another venerable public polling organization, Gallup, reported that just 27% of Americans expressed confidence in their institutions—the lowest level of trust since the questions were first asked over 50 years ago. And that lack of confidence was widespread across U.S. institutions—Congress, the presidency, the Supreme Court, the military, business, police, media, churches, schools and more—14 institutions in all. The average confidence level—27%, as noted above—has declined from 46% in 1989. Americans also report having more animosity towards one another than they used to.

In 2019 political scientists Nathan Kalmoe and Lilliana Mason found—based on the Cooperative Congressional Election Study—that nearly half of registered voters think that the opposing party is not just bad but “downright evil”; nearly a quarter concur that, if that party’s members are “going to behave badly, they should be treated like animals.”  So the issue of “trust” is not reserved for just government. Levels of trust in this country—in our institutions, in our politics and in one another—are all in decline. And while opinions of individual institutions do vary among groups, the overall distrust of institutions is universal, with little variation by gender, age, race, education or even party.

Explanations are hard to come by.  One factor may be economic stagnation. Social scientists tell us that 90% of Americans born in 1940 could expect to make more than their parents; for those born in the 1980’s, the rate has dropped to only 50%. Across the developed world, the poorer and less educated you are, the less trusting you tend to be. Another factor identified by Professor Benjamin Ho of Vassar College is an increase in ethnic diversity. In the U.S., he suggests, the prospect of a nonwhite majority in a country that once enslaved Black people may be intensifying tribalism. Tribalism can promote trust internally and mistrust externally—high trust within certain groups or clans and very low trust among them. And technology has made it easier for media outlets to cater to niche audiences. Doesn’t it make sense in fact to place more trust in news and news sources that confirm what you already “know”? 

The partisan rancor that is so common in our country today actually makes it much harder to measure trust. Survey questions that have been part of surveys for decades (e.g., an approval rating of the president) seem much less useful nowadays, when public sentiment hinges almost entirely on partisanship. One has to wonder how trustworthy our indicators of trust are. Finally, in another take on the impact of technology, author Rachel Botsman argues that advances in IT have created a new paradigm—that of “distributed trust”. In Who Can You Trust?, she suggests that the old hierarchical model in which trust was transmitted from institution to individual—think the media: CBS Evening News with Walter Cronkite—has been replaced by a lateral model in which trust flows from individual to individual.

So what can we learn from the varied research on declining trust in government and how it might be restored? My conclusion is that while there are many good reasons to make government work better and to focus on improving citizen service—and we should continue to strive to do so—there isn’t much evidence that we should count on any of these initiatives to change the decline noted by Pew and Gallup.

In fact, you can trust me on this.

Article link: https://www.nextgov.com/ideas/2022/07/uncle-sam-isnt-trustworthy-dude-so-what-america-do/374530/

Alan P. Balutis is a former distinguished fellow and senior director for North American Public Sector with Cisco Systems’ Business Solutions Group.

Written by Dave Nyczepir 
Jul 14, 2022 | FEDSCOOP

None of the nearly 80 organizations that the Cyber Safety Review Board canvassed for its first report, including many federal agencies, used software bills of materials to find vulnerable Log4j deployments.

CSRB found not every organization even had software bills of materials (SBOMs), machine-readable inventories of components and how they relate because data formats haven’t been standardized.

The Department of Homeland Securitytapped CSRB to review the U.S. response to the Log4j vulnerability, one of the most serious to date, publicly disclosed on Dec. 10. In its report released Thursday, CSRB recommended SBOM tooling and adoptability be improved to support faster software supply chain vulnerability response.

“Generally our observation is that the entities who are using open source software really should be looking to help support that community directly in getting them access to training programs, developing the tools that will make things like SBOMs adoptable and being able to measure the efficacy of the security of objects,” said Heather Adkins, CSRB deputy chair, on a press call. “And we think that’s a whole-of-community approach that’s going to be needed.”

In the meantime developers should generate and ship SBOMs with their software with plans for tooling and process upgrades upon availability, according to the report. The recommendation aligns with the Cybersecurity and Infrastructure Security Agency issuing a solicitation in May for open-source software libraries and other tools foundational to SBOMs, which many federal contractors hope become the standard for proving government-mandated compliance with the Secure Software Development Framework.

CSRB recommended agencies prepare to “champion and adopt” SBOMs as the technology matures and the Office of Management and Budget, Office of the National Cyber Director, and CISA consider issuing guidance on using software inventories and metadata to improve vulnerability detection and response.

The report further recommends government require software transparency from vendors, spearheaded by OMB and the Federal Acquisition Regulatory Council discouraging the use of products without provenance or dependence information. OMB and the FAR Council should make procurement requirements, guidance, and automation and tooling investments that set expectations for baseline SBOM information and an implementation timeframe, according to CSRB.

Board officials maintained the Log4j event is not over with vulnerable versions of the free, Java-based logging framework likely to remain in compromised systems for a decade — offering even unsophisticated attackers access. Many companies can’t quickly identify where their vulnerable code is, said Robert Silvers, CSRB chair. 

“The rate at which cyber incidents occur is rapidly increasing,” said Homeland Security Secretary Alejandro Mayorkas. “And we’re at a pivotal moment for the department and our public and private sector partners to achieve a more secure cyber ecosystem.”

Article link: https://www.fedscoop.com/cyber-safety-review-board-report-software-bill-of-materials-log4j/

-In this Story- 

Alejandro Mayorkas, Cyber Safety Review Board (CSRB), Cybersecurity, Cybersecurity and Infrastructure Security Agency (CISA), Department of Homeland Security (DHS), FAR Council, Heather Adkins, Log4j, Office of Management and Budget (OMB), Office of the National Cyber Director (ONCD), Robert Silvers, Secure Software Development Framework (SSDF), software bill of materials (SBOM), supply chain

By JOHN BREEDEN IIJULY 13, 2022 12:38 PM ET

The Navy is deploying a shipboard metal-producing 3D printer to test during RIMPAC exercises.

The advantages of installing 3D printing across the federal government could be huge, although the technology has been slow to reach that potential. That could finally be changing as the Navy has deployed the first 3D printer onboard a warship that is capable of printing reliable metal parts while underway at sea.

The government has been interested in 3D printing for a very long time. Back in 2015, I wrote an explainer-type story for Nextgovwhere experts talked about the many advantages that government would eventually gain from investing in 3D printing technology. But while those early printers were extremely interesting, they had limited use because of the substrate they used to create physical objects.

Early 3D printers only used a plastic-based substrate, which was generally fed into them on long spools, which would be melted and then repurposed into whatever object the creator wanted. The early printers were capable of producing some amazingly advanced projects, with some of them able to accept computer-aided design plan files for extreme precision. However, because of the substrate used, the final product was made of plastic, so it was of limited use. Yes, you could print a small combustion engine, a gear for a machine or a work of art, but trying to use the finished product in any practical way would probably cause it to melt or break.

The killer application for 3D printing in government came not from finding something useful that the government could print in plastic, but from improving the printers to be able to handle more durable raw materials, especially metals. Called additive manufacturing, certain 3D printers now allow the government to print products using everything from metals to composite fibers to concrete.

I recently hosted a roundtable discussionwith experts in the field of additive manufacturing. Experts working in the field explained the many advances that 3D printing has made over the years, and how that is opening up new possibilities for government service.

“We have a system that prints stainless steel, metal tools and copper,” said Tony Higgins, Federal Leader for Markforged, one of the new leaders in additive manufacturing. “A lot of our customers are using this type of technology to create functional tools, custom parts, work holdings and fixtures.”

So far, the Army has been one of the biggest proponents of 3D printing for complex construction jobs. “We have a number of different systems that can print everything from concrete, to foams, to other types of materials,” said Megan Kreider, Mechanical Engineer for the U.S. Army Engineer Research and Development Center at the Construction Engineering Research Laboratory. Kreider recently worked on an Army project where an entire bridge was constructed of 3D parts that were printed using concrete and other heavy materials.

“You have to go through a structural engineer, and they outline what the reinforcement needs to be, how it’s going to be printed, and it’s highly interdisciplinary.” Kreider said. But after that, the parts are printed, normally right on the job site, and then fitted together to form the structure.

On land, 3D printing structures in the military can save time and money for big projects. But at sea, having the ability to print a critical part on demand might be the difference between having a ship able to continue its mission and requiring it to return to port for repairs. That is why the Navy has been so interested in additive manufacturing as it evolved from more simple 3D printing. 

Last year, the Navy installed a liquid metal printer manufactured by Xerox at the Naval Postgraduate School in Monterey, California. Called the ElemX Liquid Metal Additive Manufacturing machine, it is being used to test out manufacturing during deployments, and to reduce the long supply chains needed to support ships at sea.

Apparently, the testing on land went well, as the Navy announced that an additive manufacturing 3D printer is now installed on the Wasp-class amphibious assault ship USS Essex. The printer is being tested during the massive Rim of the Pacific—or RIMPAC—2022 combat exercises taking place over the summer. The Essex is the first ship to participate in the initial testing and evaluation of an additive manufacturing 3D printer during underway conditions at sea.

During RIMPAC, the 3D printer on the Essex will be tasked with printing many of the parts that Navy ships routinely require while on maneuvers. This includes training sailors how to quickly manufacture heat sinks, housings, bleed air valves, fuel adapters, valve covers and much more. The printer on the Essex can manufacture metal parts as large as 10-by-10 inches.

According to Lt. Cmdr. Nicolas Batista, the Aircraft Intermediate Maintenance Department (AIMD) officer aboard Essex, “Additive manufacturing has become a priority and it’s evident that it will provide a greater posture in warfighting efforts across the fleet, and will enhance expeditionary maintenance that contributes to our surface competitive edge.”

If the printer performs well during RIMPAC, the Navy could expand the role of those devices. Batista said in a Navy press release that the “Commander Naval Air Force, U.S. Pacific Fleet and Commander, Naval Air Systems Command have also initiated efforts to establish an AIMD work center, solely designed for the additive manufacturing concept, and are striving towards the capability of fabricating needed aircraft parts with a 3D printer.”

So it seems like if all goes well for the 3D printer during RIMPAC, that we may soon see more heavy metal manufacturing on the high seas, and more complex and larger parts being constructed by sailors, without any assistance or materials from back on land required.

Article link: https://www.nextgov.com/emerging-tech/2022/07/heavy-metal-high-seas/374189/

John Breeden II is an award-winning journalist and reviewer with over 20 years of experience covering technology. He is the CEO of the Tech Writers Bureau, a group that creates technological thought leadership content for organizations of all sizes. Twitter: @LabGuys

By EDWARD GRAHAMJULY 13, 2022 05:40 PM ET

The agency does not have the necessary data to evaluate its IT staffing practices, according to the watchdog.

The U.S. Department of State has implemented some leading recruitment and retention practices to address its IT workforce challenges, but more is needed to strengthen and measure the effectiveness of these steps, according to a watchdog reportreleased to the general public on July 12.

The U.S. Government Accountability Office examined 15 recruitment and retention best practices for the agency’s IT workforce and found that State has fully implemented one, partially implemented 11, and failed to implement the remaining three. The leading practices that GAO analyzed focused on issues surrounding strategic workforce planning, talent acquisition, talent management, engaging employees and employee morale. 

As GAO noted, State depends on skilled IT staff in order to counter cyber threats and maintain operations across four different agency components—Foreign Service, Civil Service, contractors and locally employed staff. A lack of efficient tools for measuring the success of its current practices, however, is having a detrimental impact on State’s ability to attract and retain skilled IT professionals across these four components.

“State’s policy calls for access to timely and accurate data to set performance metrics and for a plan to monitor and evaluate progress toward achieving goals,” GAO said in the report. “However, State does not have such IT workforce data needed to set performance metrics, nor does it have a plan to monitor and evaluate progress toward achieving its goals. Consequently, State does not know if its actions are improving its recruitment and retention, and achieving its goals.”

The report identified 10 specific challenges affecting State’s ability to recruit and retain IT staff, including: low entry-level pay with no recruitment incentives, low entry-level pay raises with limited retention incentives, a lengthy hiring and security clearance process, a narrowly-focused marketing and recruitment strategy, a lack of detailed information in job postings, inaccurate job postings and the performance of non-IT work, and limited opportunities for advancement.

“For example, State has collected training performance data, but has not recruited continuously year-round for most of its IT positions or regularly assessed staffing needs,” the report noted. “If State increases its focus on recruitment and retention practices, the department can better compete with other employers for critical IT staff with key skills and abilities.” 

Citing the sensitivity of the analysis, the GAO’s public-facing report did not include three of the recruitment and retention challenges that were identified. In response to State officials’ request, GAO also removed its evaluation of IT workforce vacancies and the impact of those vacancies on the agency from the public report. 

GAO offered 16 recommendations for State to improve its IT workforce management and strengthen its recruitment and retention practices. These recommendations included updating competency and staffing monitoring tools, obtaining and tracking data to better align employee expectations with agency goals and developing strategies for recruitment and retention incentives. 

While State agreed with the majority of GAO’s recommendations, it disagreed with the suggestion that the agency expand the number Foreign Service IT positions available to external applicants year-round, citing the fact that information management technical specialist positions, for example, are more specialized roles and are only posted when there are openings. 

In comments to GAO, State said that it is working to address many of the other deficiencies identified in the report. State noted, for example, that it is drafting an IT strategic plan for the Civil Service and the Foreign Service, and that it also plans to design and implement a Foreign Service Applicant Tracking System to determine the effectiveness of the department’s recruitment efforts.

Article link: https://www.nextgov.com/analytics-data/2022/07/gao-state-department-needs-do-more-address-it-workforce-challenges/374212/