Veeam has a focus on making sure its solution is powerful but user-friendly.

Well-regarded technology guru Bruce Schneider once said, “Complexity is the enemy of security.”  This maxim is an effective way to describe how Veeam helps its customers all over the world. Veeam protects over eleven million accounts with systems that are easy to use and able to be integrated into other parts of the environment.

Today’s focus is on assisting schools to improve their defense against ransomware. We have a technology specialist from Northeast Technical College in Wisconsin sit down with Aaron Murphy from Veeam. They discuss topics like the ease of use, the hybrid cloud, and platform and tools.

Karl Reishi makes a profound observation when he says that the use of the cloud has matured. Rather than the old phrase, “Cloud First,” he suggests that the best practice is to have a reasonable plan of what you want your system to look like after the transition. Flexibility is key in the world of multiple clouds, especially when it comes to disaster recovery.

Another aspect of “cloud maturity” is realizing the two environments you plan to have this year may transition to four or five in the future. Aaron Murphy adds to the discussion when he observes that a recovery process must be in place, and assessed, for each of these environments.

From Karl Reishi’s experience, the cost of moving to the cloud is a wash. The main benefit he sees is it releases technical talent from the drudgery of security checklists and maintenance so they can concentrate on understanding the needs of students and teachers.

Few technology discussions include the concept of protecting the application in the whole lifecycle. That means protection must start during development, continue through testing, and then until the application is ended.

Today’s discussion could not be timelier. COVID has brought an increase in ransomware attacks on schools. Here, experts sit down and describe the kinds of attacks schools are encountering and offer practical remedies.

It is front-page news that COVID has impacted learners from kindergarten to high school (K-12). Assessments are being challenged, teachers are quitting, and students are frustrated. If that were not enough, we have seen that this shocking transition has left school systems open for attack.

From a strategic perspective, it makes sense. It has been drilled into adults not to click on a strange-looking email. However, COVID has forced all communications between teachers and parents to be via email. Harried and under pressure, it is not surprising that someone clicks on a phishing email.

Further, at least adults can check their credit scores and may get emails from a credit card or bank of suspicious activity. No true with a ten-year-old. An identity can be compromised online, and a malicious actor can run up thousands of dollars of purchases in a mere 30 days.

It has been reported that a school district in Iowa recently paid the ransom to get school data back.

The story must start at the school itself. Elvis Teah from the Baltimore Public School System states that the main problem is with phishing emails; he also reinforces the concept that you need an infrastructure to listen to traffic entering and exiting.

Small school districts all over the country have limited staff. When COVID hit, the limited staff had to spend most of the time making sure students and teachers had access to online resources. As a result, we have seen a spike in school attacks.

Doug Levin from K12 Security Information eXchange has a deep understanding of the situation. He thinks that smaller schools must take advantage of the information on cybersecurity available from CISA and organizations that provide K12-specific information.

Federal agencies are pushed and pulled in different directions. A notable example is the entire process of adding staff. It takes an estimated one hundred days to make a hire. Human resource professionals are pushed to speed that up. On the other hand, agencies must also comply with mandates to increase diversity. How many hours are in the day to review resumes?

The answer may be by applying artificial intelligence. Today’s discussion focuses on the ability of artificial intelligence to help speed through applications and, at the same time, be able to increase diversity in the workforce.

Joe Biden’s sweeping Executive Order improves the federal workforce by improving diversity, equity, inclusion, and accessibility (DEIA) in the federal workforce. It was announced on June 25, 2021. It is getting some momentum because in September of 2022 the Chief Diversity Officers Executive Council will look at making suggestions to help agencies achieve compliance.

It is a challenge to apply these mandates to the volume of applications received. Greg Singleton from HHS estimates they have 90,000 direct employees.  A big number for a stressed human resource group to review diversity.

Dan Hopkins from Eightfold AI states that applying artificial intelligence to this problem will start by creating overall efficiency. It can also provide deeper insights into what is required for the role. Finally, it can help oversee the hundreds and thousands of applications the federal government gets a year.

Carol J. Smith from the DoD has had an experience where she has seen bias in the methods to produce artificial intelligence. If the data is going to be collected and curated by humans, then it could have a bias. She recommends a human be integral to the process of any applied intelligence.

The federal government is trying to update much of its neglected infrastructure. They have grants available to replace bridges and roads, and even improve broadband access for everyone.

Unfortunately, many of the systems the federal government uses to manage these grants are as outdated as some of the bridges that are targeted with the funds.

Now, this would not be a cause for concern if the grants were small and manageable. However, there has been an explosion in the amount and number of grants federal agencies must manage.

In today’s discussion, the traditional way grants have been managed could be viewed as a system that needs to be updated as well. The number of grants and the amount of money is going from the millions to the billions.

Brette Fisham, Department of Treasury begins the podcast with a fantastic overview of where federal grants management was, where it is now, and where it is headed. She describes a decentralized system where each of the fifty awarding agencies had its grants management system, at one time. The systems did not talk to one another.

She mentions that it was only in 2013 that the federal government enacted grant regulations, until that time, each agency was operating under its own rules.

To add to the structural inadequacies of grants management, the application process itself has become burdensome. For example, some organizations may submit a 200-page application for a grant. Paper-based systems are inherently slow and can have constant bottlenecks.

During the discussion, the concept of centralizing and digitizing the process of application, management of the grant, and then, closing it out was described in detail.

The example of expanding broadband was brought up as a case in point. The old paper-based system was designed for a set of applicants who knew the inner workings of the government, limiting the equity of the application process.

Another benefit of a centralized grants management system was physically determining where new broadband service should be installed. A digital system would allow for a graphical depiction of geography, allowing agencies to accomplish their goal of equally distributing access to high-speed Internet.

If you want to cover the breadth and scope of protecting assets in today’s rapidly changing world, it is best to get a wide range of opinions. The diverse group who sat for this discussion come from local, state, and federal backgrounds and, because of that background, give the listener a tremendous perspective on this important topic.

The interview examines priorities, sharing threat information, and the responsibility of management to provide the time and tools for security professionals to do their job.

It is headline news when an oil line gets attacked, but our experts agree that a topic that is not newsworthy is key to keeping data safe: the basics. All three technology leaders said that one must get methodical with basics, like patching, eliminating weak credentials, and instructing staff about social engineering.

Sharing information is a much-debated topic in the cybersecurity community these days. During the discussion, Terry McGraw talked about some of the legal liabilities of disclosure in the commercial world. He suggests that systems administrators who want to share information on attacks are hamstrung by legal considerations.

This is contrasted with some of the new ways threat information is shared in state and local organizations. Jeremy Wilson from Texas lauds the ability of the Multi-State Information Sharing and Analysis Center (MS-ISAC) to help with distributing threat knowledge.

He also mentions the value of training. One department in the wide-ranging realm of the state of Texas information technology was looking at a 30% click-through rate with phishing attacks. He says that a training program dropped that click-through rate to 4%.

Terry McGraw’s final comments were very transparent. He stated that proper protection of assets may not always involve the latest and greatest offering. He suggests that leaders can get the most value from establishing best practices for patching and protecting authorized access to information.

This is a discussion that provides the listener with ideas of how agencies are adopting identification to enable to zero trust and gain some insight into the evolution of access control in the federal government.

The federal government certainly is not a monolithic enterprise; it must manage mundane requests like access to National Parks as well as negotiate atomic energy agreements.

NIST has reinforced the fact that identification is the first component of deploying Zero Trust. When a mandate comes from the White House to target Zero Trust, it makes sense that each agency will have a history of identification systems and have a different level of sophistication when it comes to identity management.

Bryan Rosensteel from Ping gives a remarkable analysis of the evolution of Attribute Based Access Controls. His purview is immense. He begins by examining the historical application of Attribute Based Access Controls. He comments they were effective but tedious to deploy.

To streamline this system, Role Based Access Controls were implemented. Unfortunately, today’s technical climate allows malicious actors to steal identities and defeat the RBAC method. Bryan Rosensteel argues that today’s dynamic system will have to revert to the precise controls that ABAC provides.

The weakness of Multiple Factor Authentication is reviewed by David Temoshok, NIST. He suggests that when a person gets a code via SMS text message, it is transmitted via the public telephone system. He calls this weak MFA. This is another reason today’s Role Based Access Control, can provide the kind of security that some agencies require.

FEMA’s needs for identification are broader than most. Dr. Gregory Edwards from FEMA understands the complexity of cryptographic identification models, but he also recognizes that he cannot give every flood victim a federally issued PIV card. Solutions must be provided where FEMA optimizes quick access to federal assistance while maintaining security controls so vital for federal information technology.

Listening to this podcast will give the listener a terrific overview of innovations in access control and the variety of ways federal agencies are coping with identification with the new focus on Zero Trust Architecture.

Some will argue that COVID has forced federal agencies to move to the cloud and drastically increased remote access.  One of the unintended consequences of this transition is a realization that the data that is created in these environments must be managed much better than in traditional, on-premises circumstances.

If agencies are all on the same page with classifying and managing data, that will reduce friction and allow agencies to get the maximum benefit of all this data and understand patterns and trends.

Hannah Hunt is the Chief Product and Innovation Officer for the Army Software Factory.  They are the leading edge at agile software development in a highly secure environment. To rapidly develop solutions, they may spin up environments where data exists for an hour.  Given those constraints, it only makes sense to have continuous security and continuous compliance with the data.

One obstacle to being able to work with data sets in an extremely flexible environment is starting with effective data management.

Unfortunately, in the commercial world and the federal government, a lot of data management is still manual.  No systems administrator would pause to automate the production of a new virtual environment, but eyebrows are raised when data is managed in an automated manner.

During the discussion, the topic of Shadow IT was brought up.  For example, if a system is set up for compliance and it takes days to get answers.

Human beings, as they will, will find ways to circumvent these compliance models and subvert the system.

That is why Dan Graves from Delphix suggests that if you produce a data management system that is compliant and fast, that will reduce the temptation for end users to set up apps that are independent of the compliance requirements.

The COVID pandemic has impacted society in many ways, this discussion looks at aspects of change in higher education in learning environments, IT transformation, and protecting the infrastructure. Companies like Nutanix offer tools and systems to reduce cost and improve cybersecurity in this transition.

Before the COVID crisis, considerations were given to online learning, but the focus was on traditional, classroom teaching. Higher education led the way in adapting to the new environment. Paul Padley from Rice University shows how his university had to drastically increase video capabilities for teaching.

Logically, the university had to buy more storage for these videos.

College systems had to learn how to manage this increase in storage. The result was the hybrid cloud world we live in today. Systems had to be improved to focus on speed and had to enhance governance to prevent cyber-attacks.

While the systems administrators had to worry about the structure of the data storage systems, the academics had to concern themselves about the structure of the classes offered. Students started to trend older with an interest in seeking new short-term credentials.

An increase in online offerings challenged leaders to improve identity access and management.  Traditional systems expected full-time students to be on campus with network access; now, we see remote students with few classes expecting the same access to college learning systems.

The federal government has responded to these needs by offering grants that can assist universities in this transition.  Many of these grants include requirements to increase cybersecurity before the aid is transferred. 

Some universities are applying virtualization to accomplish this task. Systems can be configured to allow for a “virtual” desktop.  This means that a student will be allowed access to a limited environment where strict controls are placed in a designated area. This allows Role

Cloud Service Providers have no problem sharing with you the number of data centers they own, the flexibility of options, and the ease to start in the cloud. However, what is never overtly stated is that the federal technology manager is responsible for the security of their data if it is on the server down the hall or in the cloud.

The conversational phrase is, “they are not on the hook for the security of your data.” 

Today, we have several perspectives on understanding how to protect federal data in the cloud. Experts from three areas provide their views on data protection, standards, and working in a cloud environment.

When it comes to protecting data in the cloud, Skip Bailey from the U.S. Census Bureau thinks that one needs to approach it strategically first. Each of the three main Cloud Service Providers has proprietary ways of handling aspects of data control. If you think you are going into a multiple cloud environment and plan or relying on one set of rules, you are mistaken. You will need staffing to support these multiple clouds.

As in other endeavors, standards bodies can provide guidance that can assist in coming to terms with handling heterogeneous environments, in this case, varying cloud providers. Craig Hurter from the State of Colorado suggests that one should get comfortable with ISO specifications like the ISO 17789 as well as some of the general guidelines from the Cloud Security Alliance. That way, you can compare the terms of service for each Cloud Service Provider with whatever standards you choose.

It seems likely that a multi-cloud world is where federal data lives. If that is the case, then it would behoove managers to be able to evaluate each Cloud Service Provider’s capabilities. Each cloud may have options to allow control, the key is to understand how those cloud provider’s proprietary offerings compare to commercial ones.

Sterling Wilson suggests that you start with three questions. What happens if you delete data. How easy is it to deploy Multi-Factor Authentication? What about the security of data in transit?

One concept that Craig Hurter brings up is the idea of architecting data storage in depth. The idea is that the initial system is solid, but, over time, something called “drift” takes place. Updates may not all be installed promptly; other maintenance can be delayed. What may happen is you can lose security over time, while still holding to the initial design specifications.  You may have “drifted” without knowing it.

An argument can be made that the Infrastructure Investment and Jobs Act of 2021 is a once-in-a-lifetime opportunity to ensure the viability of the American dream for the next several generations. This is an interview with a group of federal and state leaders who are serious about using the money effectively to optimize this long-term investment.

The discussion begins with an observation that COVID forced rural communities to realize that their children couldn’t attend school without broadband access. Broadband access also could improve telemedicine and business.

The IIJA addresses this disparity by improving broadband to rural areas.

Lee Jones from the USDA identifies the Rural Partners Network as a pioneer in connecting rural communities to foster economic growth. They help with navigating federal programs and listening to the community for guidance on projects. The IIJA will, by necessity, include information technology to manage the funding effectively. 

There will be rural participants who fear this concept and may not have the trust in the federal government that others have.  Shannon McCarthy from the State of Alaska understands these concerns and has incorporated ways to deal with this reluctance, including ways for citizens to be anonymous.

Everything involves risk, especially multi-million-dollar federal projects. One unfortunate circumstance is when COVID increased everyone’s online presence, there was a corresponding increase in cyber-attacks.  If the Rural Partners Network can help rural communities with understanding federal programs, then CISA also helps with understanding cyber risk.

Free information about preventing a cyber-attack is provided by CISA. Dr. David Mussington from CISA details the free tools that are available to understand these new attacks and ways to prevent organizations from digital-born disasters.