By now you have heard of the millions of dollars the federal government is making available for 56 states and territories as well as 3,033 counties.

If you are interested in taking advantage of one of these grants, then you should listen to this interview with technology leaders who are intimately familiar with how grants are assigned to improve cybersecurity for states and territories.

Some basic rules:  the funding will be distributed over four years.  However, the awards are designed to be stretched out, so year #1 goes for four years, year #2 goes for four years, and so on.

Second, the states are expected to contribute an increasing portion of the investment.  10% of year one; 20% of year two; 30% of year four; 40% of year four.

The concept is to make sure the applicant has a good plan on how to effectively use the funds over a long period.  According to CISA’s Trent Frazier, it is a formula-based grant program. The idea is for the states to use investments to close gaps or sustain abilities in cybersecurity.  He suggests the best practice here is to identify vulnerabilities – how to use investment to mitigate risk

The experts address practical aspects. For example, counties vary in size and a smaller county may not have the resources to complete an application. Rita Reynolds from the National Association of Counties suggests that help is available with the application process.  

Zhen Zhen Sun from Texas observes that this effort shouldn’t not just be a replacement of technology The idea is to replace technologies.

During today’s discussion, you will hear from subject matter experts who talk about what state and local organizations can do to prevent ransomware as well as how to prepare for the new funding opportunities that are targeted at improving defense against cyberattacks.

One of the biggest lessons of this discussion is the existential nature of a ransomware attack. According to Doug Levin from K-12 Security Exchange, in 2021 alone there were 166 cyberattacks in 66 schools.  Six of those schools had to temporarily shut down.

The experts indicated three best practices:  have a good understanding of your current situation, know what organizations offer free help, and get a grasp on how insurance works.

When you have a complete survey of your system, you will understand where you have gaps and that understanding will give you the ability to evaluate systems that can help.  One unexpected consequence of this effort is this survey can help you complete an application for cyber insurance.  Jennifer Lotze remarked that a few years ago her insurance policy application had a few questions; today’s is fourteen pages of requirements.  Also, do not be surprised if rates have gone up 30% since your last inquiry.

Historically, state governments and schools have been underfunded when it comes to cybersecurity prevention.  In an attempt to address this concern, the Infrastructure Investment and Jobs Act was passed in 2021. It allocated over one billion dollars to improve state, local, and tribal security between 2022 and 2025. 

When it comes to free services, the discussion uncovered many resources.  For starters, CISA offers Cyber Resilience Review and Ransomware Readiness Assessment; they are free assessments to know what is going on in your network.  

The Department of Education offers a website called “Protecting Student Privacy” as a service from the Privacy Technical Assistance Center that provides up-to-date information on safe practices.  

Listen to the discussion to get fantastic tips on prevention, free resources, and suggestions on how to navigate the turbulent waters of cyber insurance.

When it comes to modernization for federal IT most people focus on data centers, clouds, and agile software development.  One key part of this effort must be acquisition. This is a discussion where subject matter experts from several agencies look at some new mandates from the executive office and detail how they are implementing them.

One key motivator is the FAR change that includes recommendations to open conversations with contractors and be more transparent.  The goal is to open federal procurement to make it more equitable.

Craig Morgan from the DCMA details how they have a website that shows their strategic plan for modernizing tools and integrating the enterprise environment. They want to unify data so customers can make well-informed acquisition decisions. All participants point out how they are making their acquisition process more transparent. 

One of the most remarkable approaches was from Monica Taylor from DHA. She discusses her success using the Procurement Innovation Lab.  They have coached 148 procurement teams to lower the barrier for innovative contractors. The net result has been to encourage nontraditional contractors. The GSA takes the lead in this category with a website that includes The Nine Innovative Acquisition Practices as well as articles dedicated to keeping federal acquisition experts informed in areas of acquisition innovation.

Technology can assist in making the federal acquisition question system more equitable.  Brian McCormick from ICF points out that some agencies suffer from siloed systems, separate data sets, and isolated workflows that prevent teams in agencies from communicating accurately.  

Brian suggests that platforms exist that can implement Robotic Process Automation and protective analytics, better-leveraging data to make better-informed decisions. Procurement professionals can look at their experience with procurement and see trends. Perhaps they can see preferences for a certain kind of vendor. From there, they can address ways to make their acquisition more balanced.

This is such a detailed and nuanced conversation. Dive in to hear comments on The Price Act, The Chip Act, and much more. 

When it comes to a top ten list of trending phrases in the category of technology, “backup” never cracks the top ten. After all, you merely make a copy of the existing data --- right?  

Well, the millions of dollars have been lost to ransomware attacks have caused a sea change in approach to backups. In fact, after listening to this interview, you will see backup as an inflection point for recovery

The consensus of the subject matter experts in this discussion is to establish a strategy to prevent an attack and well as have policies in place after an attack.

One issue is the deployment of resources. Some governmental organizations are “siloed” to an extent that works to the benefit of attackers.  One scenario is the security teams think the backup is managed by the backup team; the backup thinks security is someone else’s job. This causes delays in response time. The best practice here is to have tabletop exercises where stakeholders know exactly what to do in case of an attack.

Traditional ideas of backing up once a day are finished.  One must consider backing up every four hours. On top of that, one must know where an accurate backup point exists.

During the discussion, Joseph King from CAS Severn indicated that phishing attacks resulted in a $20 billion loss in 2021 and government teams must not underestimate their opponent.

Comments from all participants indicate that cybersecurity is a cat-and-mouse game. Government agencies have backups, the attackers put malicious code in the backup.  If one uses immutable technology for the backups, then the attackers move to the next level.

Joshua Stenhouse from Rubrik talks about current attacks where the policy for retention is changed. That way, they fool the organization into not retaining data at all. If you are considering a backup option, then immutability and policy structure must be included in the requirements.

The interview gives great advice for systems managers:  do not assume backups will be there, you should evaluate your backups in a virtual environment, and don’t expect you can recover up to the last serviceable date.

Decades ago, system administrators would dream about having the storage we have today.  Very few considered the ramifications of controlling and allowing access to petabytes of data that were increasing every day.

This is an interview with several experts from federal and state organizations who share challenges in handling large amounts of data whose access must be carefully managed.  Considerations include compliance, retention, and making sure the data is accurate.

One concept discussed is data sharing. Jennifer Coester from the State of Delaware talks about groups who all agree that data must be shared between departments. The caveat is that they want access to other information but want to restrict access to theirs.  Perhaps this is not a technical issue, but a concept that should be handled in management.

Administrative aspects of managing data were reflected in comments from David Sanchez from the Air Force.  He handles completely different kinds of information and data. He observes that military organizations are so structured that initiatives from a high level may take time to trickle down to lower-level areas.

As an example, he cites policies for giving access to data. One size does not fit all.  Policies for accessing nuclear data certainly vary from policies that involve medical information.  Each functional area must have its own policies.

Medicare, Medicaid, and healthcare.gov each have tremendous amounts of information, with each category subject to specific legal limits to access.  George Linares from the CMS shares with listeners how they have successfully been able to tag data by domains.

He does warn that just because you have figured out how to manage the existing system does not mean that you will not have challenges.  There is a new federal initiative to examine health care from an equity perspective.  Data scientists must be able to go back to existing systems and pull up pertinent information that will assist in evaluating new topics like this.

Digital transformation is a phrase bandied about everywhere these days. Its application is everywhere from ordering coffee online to the Pentagon.  Just as a point of comparison, the DoD has 27 million people with over $3 trillion in assets and over 17 business systems.  The amount of complexity is overwhelming for any project involving change.

Today’s interview brings together four experts in improving the existing Enterprise Resource Management (ERP) system in the federal government. The discussion gives the listener insights into the areas of strategy, automation, and process improvement.

The DoD is comprised of individuals with strong leadership characteristics. It is possible that each leader promotes their agenda at the cost of the others, and, at the expense of the overall agency objective. During the interview today, Greg Little, DoD, reinforces the new concept of starting with outcomes. 

Once this is done, duplicative systems can be eliminated, and systems can be designed to reduce costs for the entire portfolio. The phrase that sums it up is, “have the business strategy drive the technology strategy.”

One aspect of accomplishing the digital transformation of an immense organization like the DoD is automation.

Greg Little provides more details on the complexity of IT at the DoD. There are over 25 accounting systems with more than 250 feeder systems.  Conducting an audit with this level of complexity would never be possible with a few accountants and some spreadsheets.  Automation is the only way to handle this number of systems, without it, the audit would not be sustainable.

The DoD is currently using Robotic Process Automation, and have 50 digital assistants.  Of course, the goal is compliance with financial regulations, but automation allows leaders to use data to drive decisions, tie resources to performance, and financial stewardship.

Part and parcel of these large systems are legacy ERP.  Jonathan Moak, Salesforce suggests that older systems must be incorporated into the move to the cloud. However, if can’t merely be a “lift and shift,” it must make finance part of the complete business management system. 

Enhanced flexibility and interoperability will allow leaders to gain a better understanding of the impact of financial management on the entire agency.

IBM and the Ponemon Institute have reported that the average breach cost in 2022 was $4.24 million. If that is used as a rough estimate, data breaches in state and local governments can be very expensive. There is a lot at risk and budgets are tight. State and local governments really have to look at leveraging what funds they have.

Today’s discussion provides recommendations for sources of information on hardening systems, coming up with action plans, and the role of insurance.

There is no lack of help if you are seeking guidance when it comes to making your system secure. Guides from CISA and NIST give specific information.  Most suggest starting with an accurate evaluation of what is on your system.  There may be situations where people sign up for services with a credit card without informing system managers. System surveys are difficult when one has to look for shadow IT.  

Action plans normally start with ways to respond to an incident.  One weakness in a backup playbook is the time it takes to restore one system vs. ten systems. System managers may have to get ideas on unexpected circumstances.

Best practice is to harden your system and have an action play. The unintended benefit of documenting your security is qualifying for cyber insurance.  Risk assessment can vary in size of organization.  Insurers try to limit exposure – excluding certain events. One certain bet is that it will become more and more expensive to get cyber insurance.

You may not realize that a cyber insurance package can be an 11 page application   combination of entire system – every environment will have a different footprint. Tony Lauro Akamai mentions that an insurance plan must never be considered to be a substitute for a hardened system. 

Interest in machine language and artificial intelligence has been growing and growing since around 2015. It was a perfect storm where storage prices decreased, and virtualization became standard.  Like most maturing industries, challenges appeared. It was found that the conclusions provided by artificial intelligence were dependent on the quality of the data it collected. This finding became so common that in 2020 the federal government responded with Executive Order 13960 promoting the use of trustworthy intelligence in the federal government.

This is an interview with a focus on applying that guidance across many federal areas, including cybersecurity.

Technology leaders from the National Science Foundation have formulated the National Artificial Intelligence Research Resource Task Force (NAIRR) https://www.nsf.gov/cise/national-ai.jsp  to give guidance on using data more effectively. Recommendations include the categories of security privacy, civil rights, and sustaining the resource. The goal was to help get control of the unwieldy and expanding IT environments.

Wayne LeRiche, Palo Alto Networks, gives an example of applied AI with some of the security concerns relating to Domain Name Servers (DNS).  Attacking a DNS server is a classic approach malicious actors have used for years.  The traditional method of defense is rule-based.  If “x” occurred, then react with “Y.”

Attackers can ratchet up the attack with something unknown that the rules-based system can’t handle it.  AI can handle drastic increases in speed that a rules-based system can’t. Further, artificial intelligence can understand unknown methods of denying service to the DNS.

Rather than focusing on one aspect of prevention, experts on the panel suggest that Rule-Based and Machine-Learning DNS security services be used in parallel.

Finally, Tony Walker, NetScout, presents a scenario where one part of the team is proficient in network management while another part of the team has a sophisticated knowledge of data management. The solution that is provided by AI must be tempered with careful consideration of data sources and the ability to use that knowledge in an environment full of people with different skill sets.

Both federal and civil organizations are challenged with coming up with creative ways to keep and attract a modern workforce. During this discussion, federal leaders share innovations on retaining their workforce and replacing retiring employees.   

Paul Pietsch, Partnership for Public Service brings up some shocking statistics.  In one agency, the Gen-Z makes up only 1.6% of the workforce and, in the next two years, 33% of the federal workforce in that agency will hit retirement age. This second figure is sometimes referred to as the retirement tsunami.

The experts on the panel all admit that they are presented with a challenge of retaining the younger workforce, and, at the same time, reaching out to new candidates.  The only way to reach this goal is with forward thinking approaches. 

When it comes to keeping Gen X and Gen Z on board, the federal leaders discussed topics like rotating assignments, appealing to public service, assisting with student loans, including retention bonuses, flexible scheduling, and mentoring.

Post COVID, all agencies understand the attraction of remote working and having a flexible schedule.  One creative idea that is used at the Department of Education is rotating assignments.  A manager can offer an inducement for a person to stay with the agency by offering them the ability to learn new skill sets in other areas.

Another innovation suggested by Jacqueline Clay, Department of Education, is to form cohorts of people when they get hired. You can select them for specialized training.  Because they will get to know one another, they can share knowledge in an informal manner.

Mentorship programs have been started in some agencies, normally they last one year.  In a twist, some are experimenting with reverse mentorship: where a younger person can share knowledge of topics like Slack with professionals who may have expertise in other areas.

Some agencies offer financial incentives to keep team members and will compensate for a referral that results in a hire.

Today’s young people can have college debt, some studies show the average student debt is $18K.  Some agencies are offering up to $60K in student loan forgiveness.

If your target employees are participating in social media, then a wise leader should know how to communicate in that media.  Joseph Abbott, from the USDA, remarked they created a new vocabulary where agency concepts could be understood in a world of emojis and memes.

Federal mandates include Environment, Social, and Governance (ESG) policies. Like many federal initiatives they provide broad guidance and enacting these lofty goals can be difficult.

Today’s interview looks at leaders from the federal government, state, and local who share ways they have been able to include ESG goals in their organizations

Two of the people in the podcast are from California. Traditionally, California has been a leader in these efforts for decades.  Andrew Collins, from the San Francisco Employee’s Retirement System, really sums up the challenge.  Because he has a fiduciary responsibility to the people who retire, he tries to meet ESG goals, but must include risk management along with seeking opportunities for ESG characteristics.

The world of finance and investment is full of metrics.  One challenge the discussion participants discussed is how to measure whether investments include climate change or even social equity goals. Brian Rice from the California State Teachers’ Retirement Funds lets listeners know about the 25 risk factors included in the evaluation his group uses.

Most people know that the National Science Foundation provides grants for a wide variety of needs. In response to a recent Executive Order indicating that ESG goals must be included in grant approval, the NSF has taken a slightly different tack than the state and local groups.

The NSF is looking at geographic targets for development well.  For example, they are trying to create geographically diverse communities for investment in the NSF project.  The idea is that no equity is accomplished if only one area has all the innovation.  They layer ESG goals on top of this regional approach.

One innovation from the NSF is to create a repository of information about technology projects. For example, if a person is seeking funding for a specific biotechnology project, they can easily see where similar innovators are considering launching companies.  This eliminated duplicative efforts and allowed for collaboration beyond one’s locale.

 According to a recent survey from KMPG, ESG considerations about ESG are reflected in these recent Executive Orders. Results indicate 70% government should take a role in solving environment and social issues

ESG is an issue that is challenged with the balance of social goals while maximizing financial value creation.  This podcast is a great introduction to practical ways to comply with ESG demands.