Steve Blank, Joe Felter, Raj Shah/ 11:06 AM EST•February 24, 2022

The Department of Defense, other U.S. government agencies and a bipartisan consensus in Congress realize that China is strategically leveraging diplomacy, information and intelligence, its military might and economic strength, and all other instruments of its national power to redefine the future world order.

Given China’s stated goals and objectives, we should expect continuity in this assessment in the coming decades.

To any dispassionate observer, U.S. responses to China’s aggressive whole-of-government efforts to dominate – especially in the military domain – have been piecemeal and ineffective. The systems (and people) we have in place to respond (requirements, acquisition, budgeting) were designed to optimize lifecycle cost and manage 30-year DOTMLPF processes.

Yet, we need the opposite to compete with our strategic rival – speed, urgency, scale, short life cycle, and attributable systems. Existing DoD systems are not designed to effectively tap into a commercial technology ecosystem that’s now driving most of the DoD-relevant advanced tech (AI/ML, autonomy, biotech, quantum, access to space, semiconductors, etc.)

We must more aggressively and deliberately harness the vast untapped potential of our world-renowned institutions of higher learning, namely the brilliant, innovative and creative students and faculty that flock to America’s flagship universities.

Many among the DoD’s senior military and civilian leaders understand this and have established well-intended innovation initiatives. But the enduring funding and efficacy of such initiatives often hinge on support from visionary individual leaders and are at risk when these key leaders’ tenures end.

The result is that our systems, organizations, headcount, and budget can’t scale to meet the challenge of China and other potential rivals. Our adversaries are innovating faster than our traditional systems can respond.

Many have written about reform of existing DoD systems (fix the planning, programming, budgeting and execution (PPBE) process; scale DoD accelerators and the Defense Innovation Unit; better utilizing existing acquisition authorities, etc.).

All are fine ideas, but they miss a core problem – the DoD has not engaged with commercial industry at scale. Harnessing the extraordinary potential of the U.S. private sector and bringing its vastly superior resources to bear more effectively is the key to prevailing in this strategic competition.

Silicon Valley is ready to get back in the game

For the first two decades after World War II, Silicon Valley was really “defense valley.” It built chips and systems for the DoD and intelligence community. Innovation in Silicon Valley started post-World War II with funding to Stanford University from the Office of Naval Research and then follow-on contracts from all the services to build advanced microwave and electronic systems.

The first major contract for the fledging semiconductor companies was for the guidance systems for the Minuteman II intercontinental ballistic missile and then the Apollo spacecraft. During the Cold War, Lockheed was Silicon Valley’s largest employer, building three generations of submarine launch ballistic missiles, satellites and other weapons systems. Arguably, our ability to mobilize the resources of Silicon Valley was critical to the U.S. ultimately prevailing in the Cold War competition with the Soviet Union.

Prevailing in this century’s strategic competition will require us to bring similar resources and talent to bear. Today, Silicon Valley sits at ground zero of a technology ecosystem that dwarfs the DoD, its prime contractors and federal labs. This ecosystem thrives on the toughest problems, moves with speed and urgency and, when incentivized, can bring capital and people at an enormous scale to solve these problems.

But the DoD is reluctant to acknowledge that this is a resource to tap at scale and speed. And because it hasn’t fully acknowledged it, it hasn’t considered what would be possible if you could marshal those resources.

And because it hasn’t imagined it, it hasn’t thought about what types of incentives could move the more than $300 billion per year in VC investments (versus $112 billion for DoD’s Research, Development, Test and Evaluation (RDT&E) Program or $132 billion in procurement) into areas that support dual-use activities with the potential to bolster our national security. (Think massive tax incentives, etc.)

The adage “to a hammer everything looks like a nail” aptly describes the answer to problem sets like threats to sovereignty and international law. Most thinking has been restricted to having more/better versions of existing weapon systems (ships, carriers, boomers, etc.) rather than alternate operational concepts and weapons that can be rapidly deployed to deter or win a war in the South China Sea or in the Baltics or Kaliningrad corridor.

It almost seems that conversations about new systems and concepts built around small, cheap, attributable, autonomous, lethal, mass, distributed, short-lifecycle projects from new vendors are prohibited. Yet, these are exactly the solutions an innovation ecosystem would rally around. Imagine, for example, 50 SpaceX equivalents helping to build a 21st-century DoD.

Bringing America’s best and brightest to strategic competition

Focusing and unleashing the power of the United States’ private sector and of Silicon Valley, in particular, with its unmatched innovation and extraordinary capital investment potential, can reverse the U.S. slide in capabilities relative to China and maintain our edge across a range of critical technologies.

Beyond that, we must more aggressively and deliberately harness the vast untapped potential of our world-renowned institutions of higher learning, namely the brilliant, innovative, and creative students and faculty that flock to America’s flagship universities.

We’ve succeeded at this before. Stanford and nearly every other major U.S. research university were integral to the military innovation ecosystem during the Cold War. What was unique in Silicon Valley, however, was that Stanford’s engineering department actively encouraged professors and graduate students to start military electronics companies, taking the best people and commercializing the technology to help win the race against the Soviet Union.

Inspired by this historic precedent, we recently established the Stanford Gordian Knot Center for National Security Innovation to harness Silicon Valley’s technology, talent, capital, speed, and passion for tough problems and help the United States prevail in this new era of strategic competition.

We must further advance efforts that coordinate resources across Silicon Valley and other innovation ecosystems. At our top universities, we must scale national security innovation education; train national security innovators; offer insight, integration, and policy outreach; and provide a continual output of minimal viable products that can act as catalysts for solutions to the toughest problems.

The stakes are too high not to bring all our resources and our very best human capital to the table.

Article link: https://techcrunch.com/2022/02/24/the-us-must-harness-the-power-of-silicon-valley-to-spur-military-innovation/

Esperanto Techology’s chip heralds new era in open-source architecture; Intel set to cash in

SAMUEL K. MOORE

24 FEB 2022

The adoption of RISC-V, a free and open-source computer instruction set architecture first introduced in 2010, is taking off like a rocket. And much of the fuel for this rocket is coming from demand for AI and machine learning. According to the research firm Semico, the number of chips that include at least some RISC-V technology will grow 73.6 percent per year to 2027, when there will be some 25 billion AI chips produced, accounting for US $291 billion in revenue.

The increase from what was still an upstart idea just a few years ago to today is impressive, but for AI it also represents something of a sea change, says Dave Ditzel, whose company Esperanto Technologies has created the first high-performance RISC-V AI processor intended to compete against powerful GPUs in AI-recommendation systems. According to Ditzel, during the early mania for machine learning and AI, people assumed general-purpose computer architectures—x86 and Arm—would never keep up with GPUs and more purpose-built accelerator architectures. 

“We set out to prove all those people wrong,” he says. “RISC-V seemed like an ideal base to solve a lot of the kinds of computation people wanted to do for artificial intelligence.” 

With the company’s first silicon—a 1,092-core AI processor—in the hands of a set of early partners and a major development deal with Intel [see sidebar], he might soon be proved right. 

Ditzel’s entire career has been defined by the theory behind RISC-V. RISC, as you may know, stands for reduced instruction set computer. It was the idea that you could make a smaller, lower-power but better-performing processor by slimming down the core set of instructions it can execute. IEEE Fellow David Patterson coined the term in a seminal paper in 1980. Ditzel, his student, was the coauthor. Ditzel went on to work on RISC processors at Bell Labs and Sun Microsystems before cofounding Transmeta, which made a low-power processor meant to compete against Intel by translating x86 code for a RISC architecture. 

With Esperanto, Ditzel saw RISC-V as a way to accelerate AI with relatively low power consumption. At a basic level, a more complex instruction set architecture means you need more transistors on the silicon to make up the processor, each one leaking a bit of current when off and consuming power when it switches states. “That was what was attractive about RISC-V,” he says. “It had a simple instruction set.” 

The Core

The core of RISC-V is a set of just 47 instructions. The actual number of x86 instructions is oddly difficult to enumerate, but it’s likely near 1,000. Arm’s instruction set is thought to be much smaller, but still considerably larger than RISC-V’s. But simply using a slim set of instructions wouldn’t be enough to achieve the computing power Esperanto was aiming for, says Ditzel. “Most of the RISC-V cores out there aren’t that small or that energy efficient. So it’s not just a question of us taking a RISC-V core and slapping 1,000 of them on a chip. We had to completely redesign the CPU so that it would fit into those very tough constraints.”

Notably missing from the RISC-V instruction set at the time Ditzel and his colleagues started work were the “vector” instructions needed to efficiently do the math of machine learning, such as matrix multiplication. So Esperanto engineers came up with their own. As embodied in the architecture of the processor core, the ET-Minion, these included units that do 8-bit integer vectors and both 32- and 16-bit floating-point vectors. There are also units that do more complex “tensor” instructions, and systems related to the efficient movement of data and instructions related to the arrangement of ET-Minion cores on the chip. 

The resulting system-on-chip, ET-SoC-1, is made up of 1,088 of the ET-Minion cores along with four cores called ET-Maxions, which help govern the Minions’ work. The chip’s 24 billion transistors take up 570 square millimeters. That puts it at around half the size of the popular AI accelerator Nvidia A100. Those two chips follow very different philosophies. 

The ET-SoC-1 was designed to accelerate AI in power-constrained data centers at the heart of boards that fit into the peripheral component interconnect express (PCIe) slot of already installed servers. That meant the board had only 120 watts of power available, but it would have to provide at least 100 trillion operations per second to be worthwhile. Esperanto managed more than 800 trillion in that power envelope. 

Most AI accelerators are built around a single chip that uses the bulk of the board’s power budget, Esperanto.ai principal architect Jayesh Iyer told technologists at the RISC-V Summit in December. “Esperanto’s approach is to use multiple low-power chips, which still fits within the power budget,” he said. 

Each chip consumes 20 W when performing a recommender-system benchmark neural network—less than one-tenth what the A100 can draw—and there are six on the board. That combination of power and performance was achieved by reducing the chips’ operating voltages without the expected sacrifice in performance. (Generally, a higher operating voltage means you can run the chip’s clock faster and get more computing done.) At 0.75 volts, the nominal voltage for the ET-SoC-1’s manufacturing process, a single chip would blow way past the board’s power budget. But when dropping the voltage to about 0.4 V, you can run six chips from the board’s 120 W and achieve better than a fourfold boost in recommender-system performance over the single higher-voltage chip. At that voltage, each ET-Minion core is consuming only about 10 milliwatts. 

“Low voltage operation is the key differentiator for Esperanto’s ET-minion [core] design,” said Iyer. It informed architectural and circuit-level decisions, he said. For instance, the core’s pipeline for the RISC-V integer instructions is made up of the fewest number of logic gates per clock cycle, allowing a higher clock rate at the reduced voltage. And when the core is performing long tensor computations, that pipeline is shut down to save energy. 

Other AI Processors

Other recently developed AI processors have also turned to a combination of RISC-V and their own custom machine-learning acceleration. For example, Ceremorphic, which recently came out of stealth with its Hierarchical Learning Processor, uses both a RISC-V and an Arm core along with its own custom machine-learning and floating-point arithmetic units. And Intel’s upcoming Mobileye EyeQ Ultra will have 12 RISC-V cores with its neural-network accelerators in a chip meant to provide the intelligence for Level 4 autonomous driving. 

Intel’s Big Bet on RISC-V

In perhaps its biggest move to jump-start its manufacturing business, Intel said it would create a US $1 billion fund to support startups and other potential customers of Intel Foundry Services. Though the company didn’t say where the first funds will go in announcing the fund, it is planning “investments and offerings that will strengthen the ecosystem and help drive further adoption of RISC-V.”

Putting its weight behind RISC-V was a smart move, because it makes the company seem more like a manufacturing partner than a competitor, according to Semico Research principal analyst Rich Wawrzyniak. “All at once they not only validated the RISC-V architecture, they said they’re open for business,” he says. “They’re not going to restrict people in terms of the CPU designs they want to build. That itself is probably more important than anything else.”

Intel says it will help RISC-V companies innovate faster by prioritizing their manufacturing runs and working with them to codevelop manufacturing technology that works for their designs, among other things. Intel, which is now a member of RISC-V International, singled out four major collaborations with RISC-V heavyweights that it expects will attract foundry customers:

Andes Technology: The San Jose–based company designs RISC-V processor cores for embedded systems. And through the new deal, Intel Foundry Services customers can integrate its low-power cores. Intel’s foundry capacity “ensures that SoC designs based on Andes RISC-V processor cores will achieve the production ramp and volume successfully,” said CEO Frankwell Lin, in a press release.

Esperanto Technologies:The company’s current 1,092-core chip is made using TSMC’s N7 process. Through a strategic partnership, “Esperanto is getting access to Intel’s advanced technology nodes,” says CEO Dave Ditzel. The company could make the next generation of its SoC using the Intel 3 process, he says. “That’s not one but actually two generations ahead of its current design.” With that, Esperanto could increase the number of cores on its chips or make those chips smaller. The latter is more likely, he says. Different numbers of 1,092-core chiplets could then be combined in a package using Intel’s chiplet packaging technologies to tackle a variety of tasks.

SiFive: The Silicon Valley designer of RISC-V cores and development tools partnered with Intel Foundry Services to produce SiFive’s P550 multicore processors in the foundry’s Intel 4 manufacturing process, which is set to come on line later this year. The resulting chips will go to developer boards meant to drive growth in RISC-V. It’s worth noting that SiFive extended an existing partnership with Samsung last April to integrate custom AI accelerator blocks with SiFive’s RISC-V blocks using Samsung’s foundry technology.

Ventana Microsystems: The startup has a deal to make its data-center-class tech available to Intel Foundry Services customers. Foundry customers will be able to integrate Ventana’s data-center-class cores into their SoCs using Intel’s “leading manufacturing process,” or use its multicore chiplets to rapidly make custom systems.

Turning to RISC-V was both a business and technical move for embedded AI processor firm Kneron. The company has been selling chips and intellectual property using Arm CPU cores and its custom accelerator infrastructure. But last November Kneron released its first RISC-V-based tech in the KL530, aimed at supporting autonomous driving with a relatively new type of neural network called a vision transformer. According to Kneron CEO Albert Liu, the RISC-V architecture makes it easier to preprocess neural-network models so they run more efficiently. However, “it also made sense in light of the potential Arm acquisition by Nvidia last year to de-risk ourselves of any possible business decisions that could impact us,” he says. That deal fell apart in February but would have put the provider of Kneron’s previous CPU core architecture in the hands of a competitor. 

Future RISC-V processors will be able to tackle machine-learning-related operations using an open-source set of instructions agreed upon by the community. RISC-V International, the body that governs the codification of the core instruction set architecture and new extensions, ratified a set of just over 100 vector instructions in December 2021. 

With the new vector instructions, “somebody doing their own thing in AI doesn’t have to start from scratch,” says the organization’s CTO, Mark Himelstein. “They can use the instructions that other companies are using. They can use the tools that other companies are using. And then they can innovate in the implementation or power consumption, or performance, or whatever it is their added value is.” 

Even with the vector extensions, promoting machine learning remains a top priority for the RISC-V community, says Himelstein. Most of the development of ML-related extensions to RISC-V is happening in the organization’s graphics special interest group, which merged with the machine-learning group “because they wanted the same things,” he says. But other groups, such as those interested in high-performance and data-center computing, are also focusing on ML-related extensions. It’s Himelstein’s job to make sure the efforts converge where they can. 

Despite RISC-V’s successes, Arm is the market leader in many of the markets where a lot of new AI functions are being added, and it is likely to still be so five years from now, with RISC-V capturing about 15 percent of total revenue in the market for CPU core designs, says Semico Research principal analyst Rich Wawrzyniak. “It’s not 50 percent, but it’s not 5 percent either. And if you think about how long RISC-V has been around, that’s pretty fast growth.”

Article link: https://spectrum.ieee.org/risc-v-ai

Two instances of the homegrown electronic health record have been moved to the cloud as part of a pilot project, but it’s not clear if funding or support exists for more cloud migration as VA transitions to a commercial electronic health record.

ADAM MAZMANIAN | 

FEBRUARY 22, 2022 10:00 AM ET

Kurt DelBene, the new chief information officer at the Department of Veterans Affairs, said he planned to continue support of the agency’s homegrown electronic health records system during the transition to a commercial system scheduled to be completed in 2028.

The modernization project, launched in 2017 with a planned $16 billion budget, has its own section of the VA’s budget outside the Office of Information and Technology, and its leader reports to the agency’s deputy secretary, Donald Remy. But OI&T is deeply enmeshed in the shift to the same Cerner commercial electronic health record system, providing support for infrastructure development and readiness.

At the same time, OI&T is responsible for keeping the Veterans Health Information Systems and Technology Architecture (Vista) operational. For now, most patient care is handled through Vista; the Cerner product is up and running at the Mann Grandstaff Medical Center in Spokane, Wash., and a few more deployments are scheduled in the near term.

“We’re going to be using Vista for a period of time, and during that we can’t falter on delivering great care to veterans,” DelBene said on a Feb. 17 call with reporters. “So I think of Vista as a system that we absolutely have to continue to modernize. The health care landscape changes, and Vista needs to change and continue with the great support as it has had before.”

Todd Simpson, VA’s deputy assistant secretary of DevSecOps, said on the same call that two of the 130 separate instances of Vista have been put into VA’s Amazon Web Services cloud as part of a pilot. In addition, all the backup data for Vista has been moved into the cloud.

Simpson said it was possible that more instances of Vista could be moved to the cloud. “It comes down to funding and overall strategic direction driven from [Electronic Health Record Modernization], leadership and of course the customer,” meaning the Veterans Health Administration.

Funding is a big issue for Vista, in part because its costs are difficult to measure. The homegrown application now has 130 separate instances in use at different VA facilities. 

Because of the way the legacy system has sprawled into multiple systems, “VA lacks a comprehensive definition of Vista and cannot accurately report Vista costs,” the agency stated in its 2022 budget request.

Additionally, DelBene said plans to sunset Vista will have to wait for the EHRM project to advance. “Part of that is further out,” DelBene said. “My major commitment is to continue to support necessary changes. Then we’ll figure out what transition looks like.”

Article link:
https://fcw.com/2022/02/vista-modernization-still-priority-va-funding-question/362219/

Jared Serbu Feb. 18, 2022

An influx of money from the CARES Act helped the Department of the Navy (DON) make major strides in modernizing its networks. Now, leaders say, it’s time to focus on bolstering those networks’ cybersecurity, including with a major pivot from compliance-driven approaches to a new philosophy called “Cyber Ready,” which focuses instead on continuous monitoring and ongoing risk assessments.

The idea of keeping constant tabs on a system’s cyber health certainly isn’t new — indeed, it’s central to the National Institute of Standards and Technology Risk Management Framework DoD already uses to authorize systems on its networks, as a theoretical matter anyway.

But Navy IT leaders think they’ve hit on a new framing that will help with the cultural changes needed to actually, finally, move away from checklist-based, single-point-in-time security approvals.

Aaron Weis, the Navy Department’s CIO, said describing the problem in terms of “readiness,” akin to the way the military measures its servicemembers and weapons systems’ ability to execute missions on a day-to-day basis, has found a good deal of resonance in the Navy and Marine Corps.

“The whole approach is that we measure readiness in a very holistic way, and it’s something that you dynamically manage,” he said this week at the Navy Department’s annual IT conference in San Diego. “It’s taking the way that we measure ourselves in a very complete way and bringing that to the topic of cybersecurity, and my sense is we’ve really hit on a message that resonates — an approach that can bear fruit — and we’ve gotten really favorable engagement on this idea.”

Exactly what “Cyber Ready” looks like in practice is still to be determined. The concept has only been under discussion since October, and the DON plans to test it with a handful of pilot projects in the coming year before drawing any broad policy conclusions.

But Weis said a key objective is to move away from the current practice of granting systems an Authority to Operate (ATO) once every three years. That approach, he said, incentivizes “bad behavior.”

“One of the things that we’re saying as part of Cyber Ready is that the idea of a three-year ATO is wrongheaded — you fill out a giant spreadsheet and do 10,000 pushups and then you get an ATO that’s good for three years,” he said. “People get that ATO and they go, ‘Yeah, job done.’ And then what happens? Over the next three years, that system hasn’t evolved or been updated. It’s no longer secured, and it ends up as a high-risk escalation that ends up on my desk. We need to get to this idea that you’re always earning your ATO. There are a lot of snazzy phrases for that, like continuous ATO, but the idea is you’re always earning and re-earning your ATO every day.”

And Navy IT leaders think their technology developers are hungry for changes along these lines.

Jane Rathbun, the deputy assistant secretary of the Navy for information warfare and enterprise services, said the acquisition community is often frustrated by the process of building new systems and only turning them over to cybersecurity officials for review and approval once they’re ready to deploy.

She said developers would actually prefer to have the CISO community embedded in their programs from the start.

“They also see a need for common platforms so that they can abstract the actual capability from the IT infrastructure, so that that can be prepared and ATO’d — and not repeated every time we want to add real capability to the Navy and to the Marine Corps,” she said. “They want inheritance. If we’ve gotten Marine Corps approval on some platform or solution that we now want to use in the Navy, we’re all one big happy family. We don’t need to be doing things twice … They do agree that they must comply with cybersecurity, and they want to do that. That’s never been the problem, it’s just about how we get there.”

Cyber Ready also dovetails with an effort the Navy has already had underway for the past two years to streamline its implementation of the Risk Management Framework. Since then, the Navy has reduced the number of security controls it considers “critical” from about 600 to just 72.

And Rear Adm. Susan BryerJoyner, the Navy’s chief information security officer, said her service is looking for ways to automate security checks for many of those remaining controls.

“We also have a commercial solutions opening for the tools that allow us to automate the workflows associated with the compliance checks, because there will still be compliance checks,” she said. “This is not the ticket to say nobody ever has to scan or patch again. This is the ticket that says we’re going to figure out a better way of understanding how well you’re scanning and patching. And on a near-real-time basis, we’re going to identify the vulnerabilities the Fleet Cyber Command commander needs to know about to order a network maneuver when we have unacceptable risk on the network.”

The new approach is also likely to lean heavily on automated approaches to red-teaming and penetration testing, according to Renata Spinks, the Marine Corps’ CISO.

While there’s definitely no intention to eliminate human red teams, the sea services do need ways to test their defenses against real-world threats on a much more ongoing basis, she said. And the frequency of those checks will often be determined by how much risk the DON is willing to accept for a particular system or segment of the network.

“If we use real-time information from the people who are closest to the network, our policy should align to what’s been proven. We shouldn’t set policy and try to make people retrofit their systems with some grand new idea, because that policy is going to be reversed,” she said. “Pen testing will not only tell me how ready you are, but it will also teach me the new things that the adversary is doing. What are some of the things that maybe we’ve become complacent about? Or, do passwords need to be 16 characters? Maybe that’s no longer effective. We need to know how to be ready for the next thing, not if it occurs, but when it occurs.”

Article link: https://federalnewsnetwork-com.cdn.ampproject.org/c/s/federalnewsnetwork.com/navy/2022/02/navy-plans-to-become-cyber-ready-by-ditching-compliance-obsessed-ato-processes/?

Written by Billy Mitchell
Feb 10, 2022 | FEDSCOOP

The Department of Defense must take space into consideration while developing a zero-trust security framework across its enterprise, CIO John Sherman said Thursday.

The DOD‘s evolving mission in space defense with the recent standup of the U.S. Space Force will be inherently digitally focused. And as the U.S. competes more with near-peer adversaries like China and Russia, securing and defending assets in space from cyberthreats is a growing concern for Sherman, he said at AFCEA NOVA’s Space Force IT Day.

“I want to extend [zero trust] to not only when you think terrestrial domain and kind of traditional networks,” he said. “I think the space piece has got to be a critical part of this discussion. And I look forward to engaging the Department of the Air Force and our Space Force colleagues as we see how this can be applied.”

Sherman said the adoption of a zero-trust framework is a top priority for his office, adding that the topic is “very much prominent right now with the president’s [cybersecurity] executive order of last year.” He highlighted the Defense Information Systems Agency’s Thunderdome program and the move to Microsoft Office 365 as “examples of what a zero-trust framework can look like for the entire Department of Defense.”

And there’s no reason space should be thought of any differently, Sherman said.

“How does zero trust relate when we’re talking about things in orbit? I think it relates in many ways,” he said. “As you look at the entire segment, from the space segment down to the ground, there’s plenty of opportunities for us to microsegment, to think differently about access, about multifactor authentication, about not trusting any piece of that in a way that we have in the past and assuming a very sophisticated adversary is trying to get to our most precious data and dataflows on there.”

Sherman said the department is dealing with a host of technical debt after it spent much of the past decade “kick[ing] the can down the road a bit” while conducting operations in Iraq, Afghanistan and the Middle East. Encryption is one area in particular that “we have to get after with alacrity now,” Sherman, if the U.S. is to maintain its defense prowess.

“Cybersecurity has to be considered a survivability imperative, just like chaff, flares, armor or other capabilities,” he said. “And as we get to on-orbit capabilities, which get into other types of classifications, you can let your imagination run in terms of other types of defensive things we have to have. Cyber cannot be an option anymore.”

Sherman also hopes the Cybersecurity Maturity Model Certification (CMMC) — which was recently transferred to Sherman’s oversight — will “help raise the waterline” for the security of defense information handled by DOD’s industrial partners. And while contractors may be concerned by the costs imposed by CMMC, Sherman said it’s more costly to deal with the consequences of not being secure.

“You know what else costs money: exfiltration of data you and your company have spent blood sweat, tears, and a lot of money to develop that’s going to end up on a weapon platform in Shanghai or outside of Moscow,” Sherman said. “We’re not gonna let that happen on our watch. This is basic hygiene to raise the water level to make sure we can protect our sensitive data so when our service members have to go into action, they’re not going to have an unfair position because our adversaries have already stolen key data and technologies that will put them at an advantage.”

Article link: https://www.fedscoop.com/space-is-a-critical-part-of-dods-move-to-zero-trust-cio-says/

Asheem Chandna Contributor

Feb 10, 2022,12:00pm EST

I have followed the evolution of cybersecurity for almost three decades. The one constant is that as quickly as the underlying technology advances, so, too, does the cyber threat.

To understand how things might play out in the coming years, I spoke with four cybersecurity experts, each of whom brings a different lens: a national security leader; a pioneering technologist; a veteran CISO inside one of the most sophisticated technology companies; and a prominent cryptography professor whose students will invariably shape the course of the field.

They are unified on one point: cybersecurity has never been more central and more complex. No one can afford to fall behind.

The National Security Dilemma

Richard A. Clarke’s experience in cybersecurity and counter terrorism stretches across three decades of service at the State Department, the Pentagon, and as counselor to three US presidents. Today he remains an indispensable advisor to countries and businesses on cyber risk and one of the preeminent thought leaders in the space.

As a national security matter, Clarke believes the US government is well-organized for cyber defense, but persistently falls short of providing adequate funding. In a recent conversation with me, he suggested that most informal, criminal hacking organizations around the world could probably be shut down by a combination of the NSA, CIA, FBI, and Cyber Command – “if only the US was willing to expand the resources it now devotes to counter-cyber warfare.”

Nation-state cyber terror is a different issue. “Iran, Russia, China all have cyber vulnerability. But so do we,” he points out. In the current conflict between Russia and the Ukraine, he worries that every non-cyber move by the US – say, shutting down Russian access to the SWIFT messaging system – could trigger a damaging retaliatory strike against US critical infrastructure.

“The problem is that we don’t know how to handle the escalation of cyber warfare between countries,” he told me. New strategies need to be developed. He cites the 1965 seminal work by strategist Herman Kahn, On Escalation, which addressed how major powers could contain and manage the risks of nuclear conflict. “We need a similar roadmap for managing escalation in cyber attacks.”

Clarke’s concern for businesses is a repetition of the SolarWinds attack that went undetected for months. “The biggest threat to most companies is a cyber attack that comes through the software supply chain. That’s what happened to SolarWinds. Today, every company gets a staggering number of software updates every month.”  

Companies are vulnerable with no clear place to seek help. “The US government would likely come to the aid of a major defense contractor hit by a cyber attack,” Clarke said. “Large banks might also expect support. But other companies need more clarity about whether or when US government resources would be deployed to help them recover from an attack.”

The Problem of Cybersecurity Complexity

Nir Zuk, the legendary founder and CTO of Palo Alto Networks, remains frustrated by a fundamental truth of cybersecurity: customers have no credible way of knowing whether the products they’ve purchased actually work. Failures are only discovered after an attack has breached their security.

Zuk believes this is one reason why cybersecurity conversations have moved up the ladder of the enterprise hierarchy, from engineers to the CISO to the CEO and the board. He sees growing awareness at all levels of business that simply buying the latest vendor “solution” is no longer a viable strategy. Enterprises must understand why cybersecurity is growing both more sophisticated and more difficult to manage.

According to Zuk, operationalizing cyber systems is the bottleneck. Customers can’t keep up with the volume of information generated by cloud and machine learning technology. An alert about a potential breach might show the whole chain of the attack, stretching back into the architecture of the interconnected components in the cloud. “It’s very hard for any human to absorb and respond to all that information,” Zuk says.

This dynamic makes automation of security crucial and inevitable. But Zuk worries most vendors and companies will get it backwards. Rather than “adding one more automated feature to human tools,” he advocates thinking about automated security the way Tesla thinks about autonomous driving: first create the autonomous products, then add the human factor.

Two threats concern him. First, ransomware continues to spread with impunity. No foolproof system exists against an attacker who only needs to be lucky enough to breach your system once. The best antidote, he argues, is to turn the tables by focusing on how to detect a breach once it has penetrated the system; that’s when the attacker must hide 100% of the time. But he quickly concedes that a good backup and data protection plan may still be the best strategy.

Supply chain attacks are the second major threat and are hard to prevent because the enterprise that is victimized is not the first target of attack. Instead, hackers are going after the vendors in their supply chain, exactly what happened in the SolarWinds attack.

The problems, Zuk believes, are knowable. The challenge is how companies will respond.

The New Corporate Imperative

Phil Venables was already an established and highly respected figure in cybersecurity when he joined Alphabet as Google Cloud CISO. He spent over two decades at Goldman Sachs as both CISO and chief operational risk officer.   

When he looks at today’s risk landscape, he sees many companies still thinking about cybersecurity the wrong way. “Companies are rushing to invest in cyber software without modernizing their underlying technology,” says Venables. “They are effectively trying to build a fortress on sand.”

Venables argues the cloud should be viewed as a “digital immune system.”  He concedes this may sound self-interested for Google’s Cloud CISO. But his case is hard to refute. Writing recently in Forbes, he described the cloud’s persistent ability to update, adapt, and respond to shifting threats as “an accelerating feedback loop” for enterprise IT leaders.   

In the coming years both executives and corporate directors will need to become more sophisticated, Venables believes. Not about the technology itself, but about how to build security into products and processes. Venables argues, business leaders should be prepared to talk about the digital underpinning and security of a product, just as knowledgeably as they would about supply chains or customer relationships. “Think about secure products, not security products.” 

Venables proposes an exercise for a board. Instead of quizzing CEOs and their teams about patch updates or the latest security scanners, directors should ask simply how often the organization updates its software. Not long ago, IT teams boasted about quarterly updates.  Venables says that leading-edge companies are typically updating software multiple times a day, or more. That’s the reality of an agile approach to cybersecurity.

The Next Frontier

Dan Boneh is a leading professor in applied cryptography and the co-director of Stanford’s computer security lab. He enjoys a distinct advantage in the world of cybersecurity: he sees what new problems fascinate his students.

Not surprisingly, they are gravitating to a set of problems around blockchain security. One involves the scalability of cryptocurrencies such as Bitcoin or Ethereum, which currently are restricted to conducting about 15 transactions a second. Yet as demand goes up, this limitation is causing transaction fees to rise. The research question is how to move far beyond the 15 transaction-per-second limit without compromising the integrity of the system.

The other security issue with blockchain is privacy. While the virtual ledger offers efficiency and accountability for all types of enterprise transactions, the very nature of blockchain requires that the information can be viewed by others. This is a challenge for companies that want to pay suppliers or even employees through a blockchain system. Researchers are exploring how this can be done securely, without compromising competitive or personal information.

Boneh and his students are also focused on a threat that he believes remains overlooked by most enterprises: adversarial machine learning. For some time, engineers have been refining machine learning algorithms so that a robot or a vehicle can reliably recognize patterns: say, defects in a product or the difference between a stop sign and a yield sign. But Boneh points out that “a growing number of results show how to attack these models.” 

Some are breaking into the training data algorithms that make machine learning possible. Others are extracting the model and effectively stealing it so that those with malicious intent can query it for the purpose of infiltration. As machine learning becomes more essential to advanced business operations, a new front of vulnerability opens.

He sees other technical vulnerabilities in the world of cyber defense: how to secure code depositories such as GitHub or how to protect package management systems that automate the uploading and updating of software. The fundamental problem, he argues, is that “the security industry is reactive. It is always focused on last year’s problems.” His research and students are a valuable counterweight to that tendency.

Cybersecurity Remains Foundational

While each of these experts have a distinct vantage point, they affirm that, in the midst of much technology innovation, cybersecurity remains foundational, growing, and increasingly complex.  As they point out, AI and machine learning, the balance of security and privacy, the vulnerability of supply chains, the growth of the cloud and blockchain, and the demand for automation are fueling frenzied activity in this space.

We see it in venture capital. During the past two years, there has been a surge of entrepreneurs with new approaches to cybersecurity, and nearly all of them are magnets for capital. Barely a day goes by when I don’t hear from a fledgling cyber start-up. Today there are over two dozen pure play cybersecurity companies that have gone public. More will inevitably follow. The demand is unrelenting.

The reasons are obvious. Cybersecurity has become a kind of virtuous circle. At one time, a breach of a legacy server inside a corporation was disruptive, but its consequences limited. In a world increasingly dependent on interconnected services and users, any single breach has deep ramifications and the potential to create havoc. Cybersecurity remains a long game.

Article link: https://www.forbes.com/sites/asheemchandna/2022/02/10/the-long-game-in-cybersecurity/?

(Disclosure: Greylock is a founding investor at Palo Alto Networks and I am on the company’s board of directors.)

BY: GRACE DILLE FEB 18, 2022. 2:24 PM

The Department of Veterans Affairs (VA) has faced a troubled rollout of its Electronic Health Records Modernization (EHRM) program, including underreported costs, deficiencies in training, and diminished employee morale. But VA’s recently installed CIO says the agency is coming to grips with those problems and looking for better performance in coming expansions of the program.

Kurt DelBene, who took over in December as VA’s Chief Information Officer (CIO) and Assistant Secretary for Information and Technology, acknowledged during a Feb. 17 call with reporters that the agency could have done a better job in areas such as training. But he also made clear that the rollout itself is “an enormous” task that’s bound to come with lessons learned along the way.

“At its heart, I think that it was always going to be a challenging rollout because electronic health record systems are difficult things to deploy, generally speaking,” DelBene said. “I don’t think there’s anybody in the industry [who] wouldn’t say that.”

The new EHRM program aims to provide a seamless experience for veterans as they transition from receiving care from the Department of Defense (DoD) while on active duty, to receiving care at VA facilities. However, replacing an EHR system that was developed by the VA in the 1980s is not a simple task.

DelBene explained the EHR system that is being replaced – the Veterans Health Information Systems and Technology Architecture (VistA) – “tailored itself deeply to the way that the VA works in particular.” He emphasized the transition for VA clinicians early on “was going to be disruptive.”

VA Office of the Inspector General reports revealed just how disruptive it was, finding “significant deficiencies” in training for the program at the first EHRM deployment site: Mann-Grandstaff VA Medical Center in Spokane, Wash. The OIG reports also found worsened employee morale as a result of the EHRM program and employee concerns about the Cerner Millennium system it runs on.

The Road Ahead for EHRM

DelBene acknowledged the VA’s missteps at the first EHRM launch site and said the agency “could do better in terms of training” going forward.

The assistant secretary also explained that getting the balance right between workflow changes and system changes “is really, really difficult and we could have done a better job there as well.”

“I think our level of preparedness overall for Mann-Grandstaff could have been stronger. And I also think that the clear criteria that we should meet before we go live could have been crisper,” DelBene said.

Neil Evans, a VA physician and the former acting CIO of the agency, said the DoD also “struggled with some of their early sites” with their Cerner rollout, but their lessons learned “are now paying dividends as they’re rolling out.” The DoD has now deployed the same EHR solution at over 50 percent of their sites, according to Evans.

“Transitions are hard and the first place you go, there are going to be lessons learned,” Evans said. “A lot of this is that we’re still relatively early in this transformation journey and … coming at this with a learning mindset and applying lessons learned as we move forward.”

DelBene is hopeful as the VA looks ahead to its next deployment site in Walla Walla, Wash. The VA has “done a lot better job in terms of getting those criteria set and established,” as well as “being collaborative with the clinicians,” he said.

“I feel particularly good about where we are right now with Walla Walla. But again, we’re going to look and see if anything changes that would require us to move that,” he added. “We are on track, but we’re going to make sure that we’re responsive to the stakeholders when we make those decisions along the way.”

Laura Prietula, the new deputy CIO for the EHRM program, said the VA is also establishing a deployment assurance team within the DCIO group. Prietula said the deployment assurance team will be focused on ensuring VA sites have a deep understanding and awareness of the EHRM transformation – from a local IT perspective and the overarching VA IT community.

“This is not just a simple technology implementation,” Prietula said. “And so we want to make sure that the facilities are also ready for those changes from their own process perspective, not just, ‘Are you ready to receive the system?’ So, we’re working very, very closely with the facilities, and we’re setting up different practices for change management all around.”

“I think the actual transformation is going to be as much about change management and people systems and how those come in good alignment – how we work comes in alignment with how the system works – and both are going to adapt to get us to a good place,” DelBene said.

Article link:
https://www.meritalk.com/articles/vas-ehrm-struggle-cio-shares-missteps-changes-for-road-ahead/

The Department of Defense’s Joint Artificial Intelligence Center recently launched new AI education pilots for thousands of DOD employees that range from executive education for general officers to in-depth coding bootcamps.

Written by Jackson Barnett
Feb 14, 2022 | FEDSCOOP

The most recent cohort of participants started taking an “AI 101” course in early February through a partnership with the Massachusetts Institute of Technology while another recently entered an AI coding bootcamp. The range of educational offerings from the AI-accelerator is designed to eventually be transitioned to other DOD institutions for tens or even hundreds of thousands of people to learn about AI, Greg Allen, the JAIC’s head of policy and strategy, told FedScoop.

“We are running training pilots to really test,” Allen said. “We partner with the broader department of defense … to help them deliver education materiel at scale.”

Allen added that “ultimately there is going to be hundreds of thousands of folks” getting some form of AI training, out of the DOD’s nearly 3 million employees and service members.

The work stems from a congressional mandate for the JAIC to develop an AI workforce and education strategy in the fiscal 2020 National Defense Authorization Act. The JAIC is now implementing that strategy through educational pilots, Allen said.

In that strategy, the JAIC identified six archetypes of AI learner: Lead AI, Drive AI, Create AI, Employ AI, Facilitate AI and Embed AI. Each type of DOD employee needs a different level of detail on AI, so the JAIC is leaning on different platforms to teach them.

For general and flag officers at the highest ranks of the military, Lead AI is an in-person seminar on the basics of what AI can do and how it will impact the capabilities they oversee. On the other end of the spectrum is Create AI, a group of coders that will be developing machine learning models for the military and need specialized training in developing machine learning models.

One of the adjustments the JAIC has made to its offerings for the Create AI category is a new coding bootcamp on the Python coding language that is often used to develop AI.

“These are folks who actually need all the skills to meet their current and future operational needs,” Allen said.

By 2023 the JAIC hopes to have all these lesson plans transitioned to other organizations, like the Defense Acquisition University or the Air Force’s Digital University.

“The No. 1 thing that brings the most joy to us is when we hear back from past participants … they put what they learned to practice in their jobs,” Allen said.

Article link: https://www.fedscoop.com/jaic-piloting-artificial-intelligence-education-for-dod/

Since its creation in 1865, the United States Secret Service has been tasked with safeguarding the integrity of the nation’s economy. Initial efforts focused on putting an end to rampant counterfeiting taking place in the years following the American Civil War, a time in which as much as 30% of circulating currency was thought to be illicit. As individuals and organized networks evolved and sought new ways to defraud the public, special agents and criminal investigators with the Secret Service have responded, applying their experience and expertise to preventing other financially motivated crimes such as illicit credit card schemes, fraudulent wire transfers, computer fraud and abuse, and, most recently, the illicit use of digital assets, including cryptocurrencies to facilitate crimes like ransomware attacks.

What are digital assets?

The term digital assets refers broadly to representations of value in digital form, regardless of legal tender status. For example, digital assets include cryptocurrencies, stablecoins and nationally backed central bank digital currencies. Regardless of the label used, or the various definitions ascribed to them, digital assets can be used as a form of money or be a security, a commodity or a derivative of either. Digital assets may be exchanged across digital asset trading platforms, including centralized and decentralized finance platforms, or through peer-to-peer technologies.

Why does the Secret Service investigate the use of digital assets?

The Secret Service is responsible for detecting, investigating, and arresting any person who violates certain laws related to financial systems. In recent years digital assets have increasingly been used to facilitate a growing range of crimes, including various fraud schemes and the use of ransomware. 

While the United States has been a leader in setting standards for regulating and supervising the use of digital assets for anti-money laundering and countering the financing of terrorism purposes, poor or nonexistent implementation of those standards in some jurisdictions abroad is presenting significant illicit financing risks that harm the American people and our foreign partners. For example, transnational organized criminals often launder and cash out their illicit proceeds using digital asset service providers in jurisdictions that have not yet effectively implemented international standards. 

The ongoing growth in decentralized financial ecosystems, peer-to-peer payment activity and obscured blockchain ledgers presents additional risks to the American people and our foreign partners. When digital assets are abused and used in illicit ways it is in the national interest to take actions to mitigate these risks through law enforcement action and other government authorities. The U.S. Secret Service is committed to doing its part to safeguard the nation from illicit activity involving digital assets.

Useful Definitions

---

Address

Used to receive and transfer digital assets between users. Addresses are managed and stored within wallets. Addresses range in character length and type, but usually consist of long alphanumeric strings.

Altcoin

Typically any cryptocurrency that is not Bitcoin. An altcoin can be a divergent of the Bitcoin consensus model or a cryptocurrency that is linked to other types of blockchains or proofs of work. For example, Ether is one of the most well- known altcoins and is associated with the Ethereum network.

Central bank digital currencies

A form of digital money, denominated in the national unit of account, which is a direct liability of the central bank.

Stablecoins

A category of digital currencies with mechanisms aimed at maintaining a stable value.

Cryptocurrency

Refers to a digital asset, which may be a medium of exchange, for which ownership records are generated and supported through a decentralized distributed ledger technology that relies on cryptography, such as a blockchain.

Wallet

Software programs that interface with blockchains and generate and/or store public and private keys used to send and receive cryptocurrency. A public key or an address is akin to an email address, and a private key is akin to a password.

Bitcoin

A type of cryptocurrency. Payments or transfers of value made with bitcoin are recorded in the Bitcoin blockchain and thus are not maintained by any single administrator or entity.

Digital asset service provider

A custodian that allows users to buy, sell, store and trade digital assets. Forms of digital asset service providers include exchanges, digital asset ATMs and over-the-counter brokers. There are many such providers operating in the United States.

Blockchain

A decentralized distributed ledger technology where data are shared across network participants and the data are typically linked using cryptography to maintain the integrity of the ledger and execute other functions, including transfer of ownership or value.

Virtual currency

A medium of exchange that can operate like currency but does not have all the traditional attributes of “real” currency, including legal tender status.

Article link: https://www.secretservice.gov/investigation/DigitalAssets

By Anton Shilov published 2 days ago

Atos’ BullSequana XH3000 to enable exascale-class supercomputers in Q4 2022

Atos has introduced its new BullSequana XH3000 hybrid computing platform that enables exascale-class supercomputers. The new high-performance computing platform is agnostic to the hardware architectures it uses, so it is compatible with CPUs from AMD, Intel, Nvidia, and SiPearl, as well as compute GPUs from AMD, Intel, and Nvidia. In addition, the platform uses liquid cooling and can handle nodes with up to 1000W power consumption. The first systems are due in Q4.

Atos’ BullSequana XH3000 hybrid computing platform will offer maximum flexibility for systems with performance from 1 FP64 PetaFLOPS to 1 FP64 ExaFLOPS (and to 10 FP8/FP16 ExaFlops for AI applications) leveraging hardware due to be released during the next six years. In addition to traditional x86 CPUs from AMD and Intel, it also supports upcoming Arm-based Grace processors from Nvidia and Rhea high-performance system-on-chips from SiPearl. Furthermore, as suggested by its hybrid nature, the platform can support next-generation compute GPUs (or accelerators), including AMD’s CDNA 2/3-based designs, Intel’s Ponte Vecchio, and Nvidia’s next-gen GPU solutions.

The future CPUs and GPUs for datacenters and high-performance computing (HPC) promise to be extremely power-hungry, which is why the BullSequana XH3000 is designed for liquid cooling by default. The XH3000 will use Atos’ Direct Liquid Cooling (DLC) solution that promises to provide ‘over 50% more cooling power than previous generations’ and enable nodes that consume up to 1000W. While 1kW of power per node may sound extreme, it looks like this will be a fairly standard energy-efficient HPC node configuration in the future. For example, rumor has it that AMD’s Instinct MI250X consumes up to 550W, whereas the industry-standard OAM form-factor for such units is designed to supply up to 700W of power.

At present, we do not know a lot of specifics about the upcoming HPC solutions from AMD, Intel, Nvidia, and SiPearl, but the very fact that Atos claims compatibility with them indicates that their general characteristics (e.g., power consumption) are known to the server maker. In fact, Nvidia states that it has worked with Atos to build the platform. 

“By combining the well-known expertise Atos has with Nvidia AI and HPC technologies and work at our joint lab, this platform will allow researchers to get significant insights much faster to grand challenges both in supercomputing and industrial HPC,” said John Josephakis, global vice president of sales and business development for HPC/supercomputing at Nvidia.

Given the availability timeframe of the first BullSequana XH3000 machines, it is likely that they will be among the first ones to support Nvidia’s upcoming next-gen compute GPUs due later this year. 

As for interconnections, the BullSequana XH3000 supercomputer architecture will support a wide range of networking technologies, including BXI, High Speed Ethernet as well as HDR & NDR InfiniBand. 

All three U.S. supercomputers announced to date rely on HPE’s Cray EX architecture that can use almost any CPU and various compute accelerators. These days Cray EX systems use AMD’s or EPYC or Intel’s Xeon Scalable CPUs along with compute GPUs from AMD, Nvidia, or Intel (when Ponte Vecchio is available). By adding support for Nvidia’s Grace and SiPearl’s Rhea, Atos offers a more flexible platform (yet we do not know what can stop HPE from adopting its architecture for Grace or Rhea SoCs).

“We are extremely proud of our role as a leader in HPC and of our new BullSequana supercomputer, revealed today, which results from 15 years of R&D efforts and brings together Atos’ proven expertise and experience in high-performance computing, AI, quantum, security and digital decarbonization,” said Rodolphe Belmer, CEO of Atos. “It will no doubt enable, through the gateway of exascale, some of the key scientific and industrial innovation breakthroughs of the future.”

Article link: https://www.tomshardware.com/news/atos-exascale-supercomputer-platform-bullsequana-xh3000