The Great Lakes used to have iron ore boats running from Minnesota to Ohio. The ship was not very agile but was unstoppable at 12 knots. There is a close parallel with the federal government.

It is such a massive entity that it is unstoppable when it sets its sights on a goal. However, when challenged with new threats, it has a difficult job altering course.

Right now, the federal government understands it is being attacked every second. Sometimes, the traditional methods can leave it vulnerable to attack.

In 2023 the Executive Office of the President released its strategy for cyber security. The 57-page document includes sixty-five specific actions to change the massive ecosystem of federal technology.

Today, we have Jim Richberg from Fortinet in the studio to break it down for listeners. His opinions are based on a twenty-year career in the intelligence community as well as decades of service in many organizations like AFCEA, the World Economic Cybersecurity Leadership Forum, and the Forbes Technology Council.

During the interview, Jim gives you the salient points. He suggests that the shift of liability from the government to commercial organizations is a major point. From a software development perspective, Jim Richberg argues that the shift to the left into incorporating security into software design is significant as well.

This episode will help you put the new strategy in perspective, and you can see how it impacts your agency.

Follow John Gilroy on Twitter @RayGilray

Follow John Gilroy on LinkedIn  https://www.linkedin.com/in/john-gilroy/

Listen to past episodes of Federal Tech Podcast  www.federaltechpodcast.com

During the interview, Bryan Rosensteel applies his considerable federal experience in identification to help you understand where basic MFA can be applied and when to move on to more appropriate methods of identification.

Instead of just a mere six-digit code, you may want to use a physical device like a CAC card to prove your identity. In cases like phone access where cards are not practical, you can take it to the next level. A person seeking identity verification can be identified by technology to know where you are, what kind of connection they are using if you are deploying a usual device, and even the time of day.

Federal systems are being attacked every day; it is best to understand some of the options; you must understand some of the variations on “strong” verification.

Once upon a time, surveys had meaning. However, today, if you buy a toothbrush, you are sent a five-page survey on customer satisfaction.

Let us say you are trying to comply with the December 2021 Executive order to improve citizen experience with your federal website. What kind of feedback do you expect from a typical citizen who cannot take another survey?

Today, we sat down with Matt Chong from Federal Qualtrics. They take a different approach to improving a citizen’s website experience. Qualtrics has been in business for fifteen years and is used in eighty-five of the Fortune 100. Qualtrics has a unique way of listening to users: by leveraging unstructured data.

During the interview, Matt Chong admits that one can listen to a phone call and get a good guess at citizen sentiment. However, given limited resources, this approach does not scale. Qualtrics has the technology to look at conversational analytics. They can have a conversation and can generate an enormous amount of insightful information quickly.

Even if you had a staff of dozens, you would not be able to accomplish the speed this innovation takes from unstructured data.

Matt Chong shows you how to go from “listening” to “understanding” to being able to act on the information provided. You can automate the tedious job of call volume, website visits, and citizen profiles into one system that puts you in the driver’s seat when it comes to analysis.

Federal websites have gone beyond HTML and heat maps. The maturity of understanding citizens is at the next level – the level needed to be able to improve the customer experience at many distinct levels.

Follow John Gilroy on Twitter @RayGilray

Follow John Gilroy on LinkedIn  https://www.linkedin.com/in/john-gilroy/

Listen to past episodes of Federal Tech Podcast  www.federaltechpodcast.com

Advances in artificial intelligence are being released every day and being proposed as solutions for federal problems. Anyone who has raised children through their teen aged years is aware of the phrase, “unintended consequences.” 

We must be careful not to be dazzled by modern technology and not realize what unintended consequences are in store before we understand the ethics of modern technology.

Today, we have Reggie Townsend, the Vice President, of Data Ethics at SAS in the studio. He provides listeners with some commonsense guidelines to use artificial intelligence ethically.

In addition to his technical expertise, he is a member of the National Artificial Intelligence Advisory Committee.

During the interview, Reggie talks about the problem in data collection. How do you know the data set the AI model was trained on? Is it a biased data set? How can you identify bias? SAS has worked at many levels of the federal government to solve some of these perplexing dilemmas.

 It seems to come down to trust. A recent survey by Pew Research shows that 20% of Americans trust the government. Reggie suggests that one way to eliminate bias is to work with more diverse teams.

The government is responding to some of these issues of trust. The Executive Office of the President has seen this situation and has offered a “Blueprint for an AI Bill of Rights: Making Automated Systems Work for the American People” back in October of 2022.

SAS has a website dedicated to helping people gain a better understanding of accessing quality data in an ethical and human-centered world.

Follow John Gilroy on Twitter @RayGilray

Follow John Gilroy on LinkedIn  https://www.linkedin.com/in/john-gilroy/

Listen to past episodes of Federal Tech Podcast  www.federaltechpodcast.com

The federal government has been told to move to the cloud since Vivek Kundra famously coined the phrase “cloud first” fifteen years ago. Unfortunately, somehow the “how” was not included in the prescription.

In an attempt to achieve assigned goals, we have seen agencies “lift and shift” on premises applications to the cloud.  There is the checkbox complete. A simile here is you have a broken-down Fiat in your garage, you move to California and put the broken-down Fiat Spyder in your new west coast garage. Different garage, same malfunctioning automobile.

Why not take advantage of some the unique capabilities the cloud provides in order to leverage this cloud transition?

Today, we sat down with Brandon Hertel, Software Developer for Vidoori. We begin the interview by expanding on some of the flexibility the cloud provides and how a federal agency can use this. The focus of the discussion is coming to terms with the expression “cloud native.”

Brandon argues that “cloud-native” is an approach to software development, we take as an example a federal agency that wants to take an application to the cloud.

We begin the interview by talking about concepts that are part of being cloud native. Brandon Herte. Defines ideas like DevSeOps, Cloud Native Open Standards, micro services, and containers. From his perspective, a federal agency can take an application, move to the cloud, and then include these concepts in order to achieve the goals of scalability, flexibility, and being agile.

This is an interview that gives you a better understanding of some of the concepts of “cloud native.”

Follow John Gilroy on Twitter @RayGilray

Follow John Gilroy on LinkedIn  https://www.linkedin.com/in/john-gilroy/

Listen to past episodes of Federal Tech Podcast  www.federaltechpodcast.com

Painting with a wide brushstroke, there are three kinds of data:  data at rest; data in transit; and data in use. Today, we speak to the person who pioneered the concept of protecting data in use. Her name is Dr. Ellison Ann Williams and has an impressive background, having an MS in Mathematics, an MS in Computer Science, and a Ph.D. In Mathematics. Additionally, she served at the NSA for ten years and has a thorough knowledge of federal security requirements.

Let us state the challenge:

tech companies are scraping the Internet for as much information about users as they can. Storage is cheap, and they are running amuck. The regulation came in a delayed, haphazard, and geographically disparate manner.

On the other hand, this kind of information can assist communities to help solve common problems. Allowing cross-border and cross-sector collaboration can result in impressive results. It is possible that longitudinal studies derived from this “scraped” information can help in medical analysis.

Dr. Williams suggests that innovation in Privacy Enhancing Technologies (PET) can balance both requirements. Further, the technology that allows for advances in-store & compute can also help to provide PET innovation.

During the interview, Dr. Williams introduces homomorphic encryption. This is certainly not the place to dive into what it means for the federal audience. You may want to go to enveil.com/FAQ to start your understanding.

Collecting data is easy, figuring out how to use it to benefit humankind and, at the same time, protecting privacy is the new world we live in. Dr. Ellison Anne Williams has some solutions.

Follow John Gilroy on Twitter @RayGilray

Follow John Gilroy on LinkedIn  https://www.linkedin.com/in/john-gilroy/

Listen to past episodes of Federal Tech Podcast  www.federaltechpodcast.com

Most listeners have heard of Palo Alto Networks. Today, we bring in Eric Trexler to give us an overview of what the venerable Palo Alto Networks has developed to help federal agencies reach their goals.

Eric started his career as a U.S. Ranger and has held leadership positions in many companies. He has chosen to work for Palo Alto Networks because he views it as the largest cybersecurity company in the world. From Eric’s perspective, he views it as the one company that can make a significant difference in protecting federal assets.

He reflects on the thousands of point solution vendors he saw at the last RSA conference. Each one may have a valid solution to a specific challenge. The problem is that most large organizations may have between 40 and 120 products, all trying to work together. If you must add constant updates to these point solutions, it makes integration almost impossible.

The same problem was faced by the information technology community with platforms; Eric suggests that there is a strategic advantage to having integration baked in before ever seeing a system.

Automation is key in managing the challenges of running a safe Security Operations Center (SOC). Eric gives an example of the efficiency that can be accomplished with SOC management by referencing Palo Alto Networks. By using a platform approach, Palo Alto Networks SOC can be managed by ten people. This is amazing when you realize that Palo Alto Networks has acquired seventeen companies in the last four years – remarkable consolidation.

Follow John Gilroy on Twitter @RayGilray

Follow John Gilroy on LinkedIn  https://www.linkedin.com/in/john-gilroy/

Listen to past episodes of Federal Tech Podcast  www.federaltechpodcast.com

Definitions are always tough in the world of networking. The initial concept was all hardware: a group of computers connected through cards, routers, and cables. Oh, how things have changed in a mere fifty years!

Software virtualization allowed systems administrators to spin up “hard drives” in no time. This was so practical that it was applied to the network itself in something called a Software Defined Network. Unfortunately, it took several decades for hardware to catch up to this kind of virtualization.

The hybrid cloud has accelerated the adoption of virtual networks in today’s federal tech landscape. Combining networks means leveraging an old concept called Application Programming Interfaces, or “APIs.”  They allowed two or more programs to communicate.

Unfortunately, this innocuous part of networking has become a target for malicious actors. During the interview, Patrick Sullivan from Akamai gives a broad background on the importance of understanding where APIs fit in federal network visibility.

Attacking systems via the API has become so popular that scraping content has gone from websites to the API itself; Patrick mentions a new phrase called, “API Scraping.”

Network managers demand visibility and awareness, it seems like they should start to consider one of the newest attack vectors, the API. There is some validity to starting to look at the API as the network.

Follow John Gilroy on Twitter @RayGilray

Follow John Gilroy on LinkedIn  https://www.linkedin.com/in/john-gilroy/

Listen to past episodes of Federal Tech Podcast  www.federaltechpodcast.com

Last year Americans lost $10.3 billion to online crime; contrast that with the estimated $1.3 billion lost to home robberies.  Today’s interview with Dr. Zulfikar Ramzan from Aura gives our federal listeners ideas on how to protect your identity.

We have learned that when a person’s identity gets compromised, it can lead directly to their employer, an especially sensitive problem when considering people who work for the federal government.

In the cybersecurity community the gold standard for a detached perspective on understanding cyber threats is the annual Verizon Data Breach Investigations Report, commonly referred to as the DBIR.

This report reinforces many of the threats presented by Dr. Zulfikar.  The DBIR shows that 74% of breaches involved the human element.  This can be anything from compromised passwords to identity theft.  In the corporate world, this can lead to financial compromise.  In the federal world, it can lead to an international incident.

Let’s state the obvious: since Covid, remote workers have taxed the ability for systems managers to protect assets with simple username and password logins. Other ways to verify identity must be considered.

Dr. Ramzan has a PhD. From MIT and 60 patents.  He was involved in a leading cybersecurity organization when he heard of the innovations coming out of Aura.  As a result, he decided to take his impressive background and hone in on helping individuals protect their identity.

Follow John Gilroy on Twitter @RayGilray

Follow John Gilroy on LinkedIn  https://www.linkedin.com/in/john-gilroy/

Listen to past episodes of Federal Tech Podcast  www.federaltechpodcast.com

A wise man once said two things can be true at once.  On the one hand, federal law enforcement agencies are being bombarded with data.  Petabytes seem to be leaking in from the roofs and seeping in from the basement. On the other hand, they are being pushed to give analysis quickly while being understaffed.

Not a problem to solve for the sight of heart. Into the fray steps Siren.

During today’s interview, Brian Gilkey explains that Siren was founded with the idea of using concepts from the semantic web to be able to absorb mountains of data, digest it, and then present the findings in an easy-to-use graphical manner.

Siren’s technology enables agencies to gather the most common data sources and most desired data sets.  They could reach into the mysterious dark web as well as social media.

Brian expands on the dilemma facing federal agencies.  Even if they have the funding to add analysts, it may take up to eighteen months to get them productive.  The graphical capabilities of Siren allow the Matrix-like stream of ones and zeros to make sense. 

If you are interested in learning more about Siren they have a free PDF titled “Investigating Data Driven Law Enforcement.” 

Follow John Gilroy on Twitter @RayGilray

Follow John Gilroy on LinkedIn  https://www.linkedin.com/in/john-gilroy/

Listen to past episodes of Federal Tech Podcast  www.federaltechpodcast.com