Zero Trust Passes Key Milestone

In January 2022, the Zero Trust Federal Strategy set a deadline of September 30, 2024, for agencies to adopt some level of zero trust architecture. Based on early indications, agencies have largely met zero-trust goals. The Federal CIO reported in early September that the 24 CFO Act agencies were all over 90% of the way to meeting the zero-trust goals. Beyond that group, the federal government as a whole was at 87% goal completion.

What's Changed?

The shift to zero trust is a response to the way government and citizens are using technology. With the increased use of cloud-based solutions, the traditional "castle and moat" security that protected on-premise infrastructure no longer supports the way applications are being deployed. Zero Trust focuses on continually verifying that users have permission to access the data and systems they are using. Gaining access requires coordination among a number of technologies that all work with a common set of user identification and access policies. Continue reading

A Look at Homeland Security Innovation Strategy

The mission of the Department of Homeland Security (DHS) is to "secure the nation from the many threats we face." An underlooked key to this statement is the word "many." Agencies under the Department are responsible for managing our borders, protecting the nation from cyber and physical threats, and supporting recovery from natural disasters and cyber attacks. To meet this mission, DHS has been embracing innovative approaches and emerging technology to supplement the efforts of the workforce charged with meeting these varied threats.

The DHS Innovation, Research & Development Strategic Plan laid out eight scientific areas as focal points for research to support national security:

  • Advanced sensing
  • AI and autonomous systems
  • Biotechnology
  • Climate change
  • Communications and networking
  • Cybersecurity
  • Data integration, analytics, modeling, and simulation
  • Digital identity and trust

As part of its work in each of these areas, DHS will be researching how emerging technology can support mission efforts as well as the risks technology poses to national security. In this blog, we'll take a look at the activity in a couple of these areas. Continue reading

Meet the Chief AI Officer

The executive order (EO) on artificial intelligence, issued in October of 2023, calls on agencies to designate a chief artificial intelligence officer (CAIO) responsible for coordinating AI use, promoting AI innovation, and handling AI-related risk management within their agency. Efforts are underway to codify this mandate, with bills introduced in the House and Senate that would turn the EO recommendation into law.

In the year since the mandate and in advance of legislated requirements, agencies have worked to not only fill but define this new CAIO role. In some instances, CAIO duties have been added to the job description for an existing executive--typically the chief data officer or chief technology officer--but in others, a stand-alone position has been created to meet the agency's AI needs. Continue reading

Remote Work Finds a Home in Government

In the early days of the pandemic, remote work seemed like a short-term arrangement, but as days turned into months, working remotely, in some capacity, became a reality for over two-thirds of the federal workforce. Today, federal employees work in an office more frequently than they do anywhere else, with telework employees spending 61.2% of their work hours at traditional federal work sites, but this means there is still a considerable amount of government work being done outside office walls.

Adapting to this new reality means taking a close look at policies and procedures to ensure that work arrangements meet the needs of employees as well as the requirements of agency missions. Continue reading

Securing the Machines that Drive our Democracy

The devices used in voting are relatively low-tech. In order to avoid cyber threats, even those that use a touch screen to capture votes are intentionally not connected to the internet. However, even this unconnected approach has security risks that need to be addressed so that these devices and the data they hold aren't tampered with. The states and localities that administer elections are continually focused on the full spectrum of security risks, putting processes and systems in place in advance of election day to ensure that voting is safe and secure.

Diversity is a Strength

The diversity of voting machines being used across the country reduces threat impacts. If there is an issue with a piece of software, it won't impact the entire national voting system, just particular machines. While software vulnerabilities are still huge problems, standardizing on one type of machine nationwide would mean one software bug could wipe out all electoral results. Continue reading