Tech Transforms

Paul Puckett, Director of the Army’s Enterprise Cloud Management Agency joins Tech Transforms to shed some light on one of government technology's most used buzzwords: Zero Trust. Listen in as Carolyn and Tracy learn what it really means to remove implicit trust and how agencies are prioritizing user experience and data protection.

Episode Table of Contents

• [01:03] The Enterprise Cloud Management Agency
• [10:41] The Context of Zero Trust
• [19:55] A Zero Trust Reference Architecture
• [29:28] Protecting the Data that Falls to the Zero Trust Architecture
• [39:00] The Traditional Dogma
• [50:07] Data Sharing on Zero Trust
• Episode Links and Resources

Episode Links and Resources

• Paul Puckett
• ECMA
• White House Memo on Zero Trust
• Zero Trust Architecture

Ross Wilkers, Senior Staff Reporter at Washington Technology talks to Carolyn and Mark about some of the hottest topics in government technology news. With insight on the 2023 Defense Funding Bill, government contracting and Alliant 3, Ross provides a unique perspective on what defense IT teams may see in the coming months.

Episode Table of Contents

• [00:56] Government Contracting and Government Technology News
• [09:21] Programs to Help Agencies
• [20:08] Fishing on a Boat for Government Technology News
• [31:37] Government Technology News Just Dominate
• [41:03] Trying to Capture HQ2
• Episode Links and Resources

Episode Links and Resources

• Ross Wilkers
• Project 38
• 2023 Defense Funding Bill
• Alliant 3

Amy Belcher, Independent Software Vender Sales and Go To Market Leader at Amazon Web Services joins Tech Transforms to talk about her team's mission to satisfy compliance for agencies across the globe. With speed to deployment, flexibility and security, Amy and her team support organizations maximizing local control and global reach.

Episode Table of Contents

• [00:52] The Importance of Industry Partnerships
• [08:19] Productive and Creative Partnerships
• [18:24] The Depth of Partnerships
• Episode Links and Resources

Episode Links and Resources

• Amy Belcher
• AWS
• The Five Dysfunctions of a Team
• Never Split the Difference

Colin Demarest, Defense Networks and Cyber Reporter at C4ISRNET joins Tech Transforms to talk about some of his recent articles focused on 5G, aerial networks, and upcoming Capability Sets. Listen in as Carolyn and Mark learn about the ever-evolving field of defense and what emerging technology can do to support the mission.

Episode Table of Contents

• [00:30] Getting to Know Colin Demarest, a Defense Networks and Cyber Reporter
• [08:45] 5G Defense Investigation
• [12:28] Issues of Compatibility in the Defense World
• [17:51] Capability Sets 21 and 23
• [25:25] Another Layer of Defense
• Episode Links and Resources

Episode Links and Resources

• Colin Demarest
• C4ISRNET
• American Ulysses
• His Very Best

Daniel Chenok, Executive Director at IBM Center for The Business of Government joins Carolyn and Mark to talk about the importance of AI in the field. From democratizing data to improving office operations, application research is a key component for any government agency looking to integrate artificial intelligence into their mission.

Episode Table of Contents

• [01:02] A Top Government Story
• [08:33] How AI Enables Us to Do Our Jobs Better
• [17:36] The Challenges We Have on Cybersecurity
• [28:47] What Does Research Tell Us About AI?
• [36:29] How AI Can Solve Problems at a National Scale
• [44:40] How to Implement AI
• Episode Links and Resources

Episode Links and Resources

• Daniel Chenok
• Email: [email protected]
• Business of Government
• Center for Government Cybersecurity
• SOCOM CDO: Digital Transformation Depends on AI
• Building the Cybersecurity Workforce America Needs

Rick Stewart, Chief Software Technologist at DLT Solutions joins Tech Transforms to give insight on Open Source, Platform One, and DORA initiatives. Listen in as Carolyn and Mark learn about the importance of focusing on the right metrics when managing security bottlenecks.

Episode Table of Contents

• [00:48] Old Ways of Doing Things
• [11:55] Security Metrics That Need Improvement
• [22:54] Deploying Security Metrics Using Scheduling Techniques
• [33:19] Continuous Authority to Operate Security Metrics

Episode Links and Resources

• Rick Stewart
• DLT Solutions
• Beyond Order

Old Ways of Doing Things

Carolyn: Today, we get to talk to Rick Stewart, a good friend. Rick Stewart is a Chief Software Technologist at DLT for more than 34 years. Do you really want me to tell people that Rick? That makes you sound super old?

Rick: No, it has some relation to the old way of doing things, traditional ways.

Carolyn: He knows the old stuff and the new stuff with 34 years of diverse experience in the IT industry. He’s progressing through technical and leadership roles in telecommunications, mobile entertainment, the federal government, and the manufacturing industries. Today, Rick is joining us to talk about DevOps research and assessments, or DORA, a term that is new to me. He’ll also talk about the four key metrics for increasing efficiency and delivering service. He will discuss how Platform One has advanced the cultural transformation to DevOps.

Mark: Welcome Rick. By the way, Rick started this when he was six.

Carolyn: That's right. I'm going, to be honest. I've been in the industry for a while, and I have never heard the term DORA. DevOps Research and Assessments make sense. I just haven't heard the acronym. They have four key metrics for increasing efficiency in delivering service. Those metrics are deployment frequency, lead time for changes, change failure rate, and time to restore to service. Will you unpack those for us?

Rick: It's interesting that you say that because I attend several different events and conferences where we have, especially in the public sector, astute people that have lots of experience.

Security Metrics As a First-Class Citizen

Rick: They're on this journey of DevOps or in the public sector. It's more DevSecOps, bringing security up as a first-class citizen. They were talking about the things that they capture, the journey that they're on, and their improvements. On one of these occasions, DORA was brought up. I think it may be a Q&A panel. It was surprising that a lot of them didn't know what this organization does, especially being so well versed in the cultural transformation, not knowing some of the things to focus on. I thought it was really important to shine a light on.

Carolyn: Is it a federal organization?

Rick: No, it's more of a community-based organization, an industry-based organization. We've got people like Jez Humble and Gene Kim and others that are involved with this. What they do is, they go out and they do surveys of not just the public sector, but the private sector, all organizations globally. They basically give them surveys and they talk about their experience, where they're at in the spectrum of their journey, and what they have discovered through this analysis. It's a really deep, long analysis.

There's a book called Accelerate that was done by Nicole Ferguson. She has a PhD and took lots of painstaking analysis of these organizations and these teams and asked them a series of questions. What it boiled down to is there are a lot of traditional metrics that have been ingrained in the industry that are useful somewhat, becoming less useful over the years, like lines of code when we're talking about mainframe and the complexity and function points, etc. As the industry has changed into more service-oriented or even micro-service-oriented architectures, those types of metrics are less useful.

Development Teams and Operations Teams in Unison

Rick: So, when you're talking about a cultural transformation of getting development teams and operations teams working in unison and collaborating together, these four metrics were decidedly important to focus on in order to strive more towards that collaborative effort. These indicate the ability to deliver software with high quality and the ability to rectify any changes or security vulnerabilities and rectify them quickly. I'll go through each one of them. Deployment frequency is how often an organization successfully releases a product to production. A product in this case could be a service, could be any kind of workload, or an application. There are differences to that.

There's an old saying that says, if something is difficult to do, do it more often and you'll get better at it and it will become less difficult. So this deployment frequency talks to that. You have to measure how many times you're deploying a particular change into production. That way, you can, A, determine your impact, the value you're having on your stakeholders, but also the ability to measure how frequently you can deliver that value.

I'll go back and forth between the private and public sectors. The public sector industry days are very interesting to me. It’s not only because that's the space I'm working in, but more importantly, it crystallized the importance of service delivery and frequency and speed. It was a Navy captain that was giving an industry because they wanted to develop a DevOps prototype. One thing that struck me was I can't wait two weeks while I'm in the middle of the Mediterranean, potentially in a firefight, to get a release, a change to an application that's not working properly.

Focusing on the Right Security Metrics

Rick: That manifested for me the importance of focusing on the right things. You have to look at your frequency and where you're deploying these changes. It’s not just through enhancements and value, but to rectify issues, defects, and security vulnerabilities.

Carolyn: Are you seeing the government agencies embrace these four metrics?

Rick: I think they've embraced a hundred different metrics, but the industry is telling them, just like it's telling them to move towards DevOps or DevSecOps, to focus more on these. Get rid of the 300-page system security procedures, that's a waste of time because you're not getting value.

Carolyn: When you say the industry's telling them, who's industry?

Rick: Industry would be the developers that are in the private sector, that are in the Netflixes, the AWSs, the industry leaders, the Googles. Those that can deploy changes and take advantage of disruptive technology and innovative services quickly. They are recognized as thought leaders in terms of what should be a measurement in terms of measuring teams' productivity when they're on this journey to DevSecOps.

Mark: Are these standards something that the DORA organization came up with? Like you talk about the industry standards, do you know where they're getting the standards from?

Rick: The deployment frequency is standard. It's always been around. You mentioned the 34 years. I've known about deployments ever since I started doing software.

Carolyn: But the DORA organization sounds like it has boiled down to these four most important metrics. You're saying from industries like Netflix, like AWS, Amazon.

Rick: Google.

Carolyn: They've looked at best practices, the metrics that really matter, and DORA said, these are the four that matter most.

Collaboration Across Multiple Teams

Rick: They can link back to the collaboration across multiple teams, which is the essence of DevOps or DevSecOps. Because these teams have different disciplines, they have different priorities, they have different measurements within their own teams, and if you can measure that you're getting better at deploying more frequently, it indicates that you're collaborating more with these teams. You're getting more rapid in terms of moving that thought from code to application to delivery quicker.

Mark: Are there metrics that they've come up with to determine what increasing efficiency means? Or are they kind of like work groups that look at thinking through what an organization might be dealing with?

Rick: Well they're looking really at the number, the sheer metric. And they divide it into four different categories of performance. You have your elite performances, I mentioned like the Netflixes, the Googles, etc. They're deploying multiple times a day, which Mark I'm sure you know in the public sector, multiple times a day, it's like a utopia for a public sector entity. They're usually talking once every six months, once every year.

They better make it successful or else they have to marshal all those resources again. You're talking about time, money, not being able to provide value, those types of things. When you're looking at the measurement of the metric itself, you're trying to categorize it to allow you to move up this hierarchy, if you're a low performer, you're maybe doing it once a week or once a month or once every six months. That's not optimum. How do you move up? You try to increase your ability to deploy faster. What does that mean?Security Metrics That Need Improvement

Rick: Talk to more groups. Get them into a room. What are the bottlenecks, the areas that need improvement? How do you work together even when you're in a different company? In the public sector, you might have different contractors, and different companies doing various different pieces of this. So it's very important to foster that collaboration so that you can deploy more. That should be the goal. How do I deploy more and faster?

Mark: One of the things that have me thinking is how can organizations strive to get to the next tier of performance in each of these benchmarks?

Rick: Other metrics lead or feed into these four different metrics. For example, your lead time for changes, which is the next metric that they talked about. This is more developer speaking, more technical. When I commit my code saying this has passed all my testing, I've got it through my team. They've looked it over. It's passed all the tests and I've committed that branch or that version of my change onto the main version control. Previously, when you developed a release, a deployment to go to production, everybody, all your developers, would make their changes and be committed to that particular release branch.

That has subsequently changed with this movement towards agile and making things more frequent, smaller deployments where each developer would have their own little branch. Once they finished their little piece of the world and passed all the regression testing, they would commit their code to the branch. Using automation, they would move that change from building the application, through test environments and pre-production, to user's test, getting approval user test, and deploying into production.

Applying More Automation

Rick: Getting that time faster allows you to deploy more frequently. That one feeds into the other. In order to focus on moving up the chain, you need to apply, in my opinion, more automation. These are very repetitive tasks.

If you've ever developed code before or you've ever developed software, it’s the combination of artistry and engineering in a beautiful dance. Because you're trying to be an artist, you're trying to be creative. You're trying to figure out what's the most elegant way to put something together but there are certain engineering tasks that have to be done. If you don't do them, it will bite you in the rear end later on down the line.

That is, constantly test, constantly scan, and constantly do the mundane tasks that allow your code not only to be elegant but to be maintainable. It’s also correct in terms of requirements and hygienic in terms of not introducing vulnerabilities.

Carolyn: But that mundane consistency, you automate all that?

Rick: Yes. If DevOps, DevSecOps is the movement or the journey, automation is the key ingredient to allow you to move faster.

Carolyn: You feel like these four metrics are sufficient but listening to you talk, there are four big rocks. And then there's a whole bunch of metrics that fall underneath each of them.

Rick: Yes. But they should be feeding into increasing your frequency, decreasing your lead time for changes, and making that smaller. Your change fail rate, you want to make that as small as possible. There are ways that you can do this with automation. Then the time to restore service or the mean time to repair, I've heard mean time to restore, mean time to resolve, mean time to remediate.

Catastrophic Failure

Rick: So MTTR, the R is interchangeable, but it means the same thing. The change failure rate is when the DevOps, DevSecOps teams deploy into production. Was that a catastrophic failure such that you had to roll back or remove that change because you're making it worse than what it was before? Speaking of industry, I was in the telecommunications industry. We were doing a lot of white-labeled systems for the wireless industry, all the big ones, the Verizons, the AT&T, etc.

They have very strict procedures on when deployments occur within windows. It's usually between 2:00 AM and 4:00 AM on a Tuesday or a Wednesday, just enough to break up your week and make developers and operations miserable. Between those two times, if there was any failure deploying your new code, no matter how important it was, you back it out. You roll it back and you try again either the next day or the next week or the next window that they had. That gets grueling. What happens if you do have a major catastrophe or a major issue with your system or your new change or your fix? It could take weeks before you can get that out.

Meanwhile, you're not producing any value from enhancements to that application because they stay behind the failed deployment. So you need to reduce that change failure rate, hopefully, to zero and the elite performers do this. They do this with many different methods. One most popular is a blue, green deployment. What they do there is, let's say you have version one of an application and it's running in production. Everything's fine.

Security Metrics to Test Operational Functional Capabilities

Rick: Now you have version two, and you want to enhance it or fix it. You deploy version two alongside your version one deployment. One blue and one green. You can test offline your new version two to ensure that it meets the requirements. It's working properly and it scales all the different operational functional capabilities that it needs to do. Then when you're happy about that, you can switch it over or you can produce a certain amount of traffic to get real traffic to it. So make sure it behaves properly. When it does, you just stop traffic to the old version and put all the traffic to the new version seamlessly with no downtime.

Carolyn: Do developers ever play games in a test environment where they blow it up on purpose so they can see how fast they can restore?

Rick: It should be part of the culture and the methodology that DevOps or DevSecOps teams have. When somebody asked me, I said, "I'm a pessimistic optimist." Meaning I want things to occur properly, but I know Murphy's involved with everything. So, let's test it before we go live because if we don't test it there, it will cause havoc.

Coming from that environment where you get one or two shots, once, twice a week, you want to make sure that you measure twice, cut once. That measure twice is testing in the test environment, and pre-production environment, so that when it gets to production, you're pretty confident that your change will work. It will be resilient enough to maintain production traffic.A Drift Within the Industry

Rick: One other point I think is a good one, I've always advocated that pre-production environments should mirror production environments. There's been a drift within the industry in terms of developers. Well, I can develop in this environment and I can push it to this environment. It looks slightly different but I'll maintain some changes here and I'll make it work. Then when it goes in production, it might be a third different environment. That's really a fool's errand, that's going to result in a bad experience. Luckily, there's some automation that makes that gap between the differences between production and pre-production a whole lot easier and a whole lot more narrow.

Mark: Speaking of automation, you've talked about this in blogs. You talked about Platform One and how it leverages new technologies and automation. Can you dig into this a little bit? First, tell our listeners what Platform One is.

Rick: Platform One is an innovative Air Force environment that is built on the Kubernetes orchestration and management framework. Now I'll explain that in a second. The second one is that it requires development teams to deliver their services, and even the tools that develop their services, in containers. Containers are, you can think of them as small virtual machines that only have application needs installed in them.

Mark: Like a modular approach.

Rick: Think of it as a widget. From an operational standpoint, they all look like several different widgets. Each one of those widgets could be a completely different language, dependency, structures, etc. inside. But from an operational capability, it is much more efficient because you can deploy these widgets as independent, generic items.

Deploying Security Metrics Using Scheduling Techniques

Rick: You can deploy them using scheduling techniques that make sure that an application's needs are deployed on a host within the Kubernetes environment. It has the appropriate resources to serve that application and enough resources that it can scale if it has too many requests coming to it. It can descale or become less in order to take advantage of resources, etc. But the application itself could be myriad languages or constructs from applications.

It’s really nice in terms of crystallizing or making concrete some of the notions that came out of the agile movement, which was each task that comes across a developer's desk shouldn't always be a Java application per se or pick a language because that's what the operational team can support.

The notion that the best technology should be used for the task at hand really makes a developer's life a lot easier. You can pick maybe a lighter-weight language or an application to create or solve the task. Then deploy it and not worry about the operational risk of not having dependencies or anything that the application needs once it goes further in product pre-production and down into production.

We're talking...

Willie Hicks, CTO of Public Sector at Dynatrace joins Carolyn and Mark to unpack the recent ATARC event: Improving the User Experience in a Zero Trust World. At this federal breakfast summit, sponsored by Dynatrace and Amazon Web Services, we heard from some of the most prominent technology leaders focused on Zero Trust including Nicole Willis, Jamie Holcombe, Mickey Iqbal, and more. Listen in as Mark and Willie give highlights and takeaways from the event. Be sure to follow the link in the show notes to see the full event On-demand!

Episode Table of Contents

• [00:30] Guest Speakers at the ATARC Event: Improving the User Experience in a Zero Trust World
• [07:55] Zero Trust Should Be a User Experience Enabler
• [14:41] OMB Is Pushing to Move Too Fast
• [20:05] How to Ensure Zero Trust Does Not Disrupt the Employee User Experience

Episode Links and Resources

• Willie Hicks
• Summit On-demand
• Nicole Willis
• Jamie Holcombe
• Mickey Iqbal
• Grant Schneider
• Tom Suder

Guest Speakers at the ATARC Event: Improving the User Experience in a Zero Trust World

Carolyn: So today we're reviewing top takeaways from ATARC 's Federal Breakfast Summit, Improving the User Experience in a Zero Trust World. Which those two things, user experience, and zero trust, are kind of a direct conflict for me, but we'll get to that. The conference was sponsored by AWS and Dynatrace, and it's available on-demand for our listeners at ATARC.org. Also, we have Willie Hicks, our Federal Chief Technologist at Dynatrace.

Willie, you were a keynote speaker at the event. I'm too biased to say you were my favorite so I won't say that. I mean, everybody was really good. Jamie was super exciting. Let me just review who our speakers were.

So our keynote speaker around zero trust was Grant Schneider. He brought a really interesting perspective because he's former white house. So he was the senior director of cybersecurity services. So former federal CISO, and now he's in industry at Venable. Then we had our next keynote around the user experience was the very entertaining Jamie Holcomb. He's the CIO at U.S. Patent and Trademark office. And then my favorite, Willie, Federal Chief Technology Officer here at Dynatrace. Then we had a panel that brought the user experience and zero trust together and how we reconcile those two and how they work together. And on that panel, we had Nicole Willis, Chief Technology Officer, OIG, at the U.S. Department of Health and Human Services.

Is User Experience Unrelated to Zero Trust?

Carolyn: Jamie came back on the panel. We had Mickey Iqbal, he's the Public Sector Solution Architect and Chief Technologist at Amazon Web Services. Willie on the panel. And then we had our moderator, Tom Suder, who's fantastic. He's been in this business so long that he had a lot of really good insights too.

Now that I've given our listeners the overview of who participated, first of all, I was thrilled to see that we had a packed room. We had a standing room only, and that was really, really nice to see. It was lovely to have people in person and to be able to interact with one another personally.

So, all right, let's get to the first question. Today, Mark, you're less of a co-host. I want to hear your opinions about what your takeaways were from that day. So around the user experience and zero trust, did you have any aha moments? What were your favorite moments? Tell me your feelings about the day.

Mark: Well you know, from my perspective, coming from industry and Dynatrace, I think we think of end-user experience as something different related to zero trust. So we think of it differently.

Carolyn: And at odds with each other.

Mark: Yes. Well, I get the feeling more and more, it's more how the end-user navigates the security protocols and processes to accomplish the end goal. Which is not their problem of zero trust, which would be the agency's problem.

How the End-User Navigates the Security Protocols

Mark: And so the agencies think of end-user experience in that light as opposed to we think of it in a different way as it relates to somewhat the same. But how end users are impacted by their interaction with applications on the internet and things like that. So I guess it's a little bit like that.

Carolyn: Did you get the sense that's how our government thought leaders that were speaking at the summit? Is that how they think of it? Or do you think that's more about how industry and we as end-users think of it?

Mark: I think that's how we think about it. I think they think about it in the former.

Willie: Yes. I definitely agree.

Carolyn: The government leadership. So Willie, talk to me more about that.

Willie: Yes. So I agree. I think it is interesting because I think our panel, and I got to talk to the panel a little bit afterwards as well. I think that Jamie from PTO standpoint and Nicole, just by kind of how they were, not just the keynote, but how we were interacting on the panel, they actually do get it.

For example, I got to have a great conversation with Nicole. It was one of those things where she was kind of talking about the service that she was trying to provide to the citizens. Because a lot of people who use HHS services and so forth, Medicare, Medicaid, those kinds of things, they might be older. They might be having a very difficult process to log into a system, to get access to a system, to get your basic information.

We’re Protecting the System, Not the User Experience

Willie: She seemed very sensitive to that, in understanding that we have to have a better user experience. And I think I got that from Jamie but at the same time, we talked about agencies as a whole and the government as a whole. There is an issue, not just zero trust. But even before this real big push for like Shields Up with CISA and all of the zero trust. We build these systems, we put up our authentication and all the things that we're going to do to protect the system, not really factoring in the customer, not really even thinking about it.

It's about protecting the system. The idea is about the system, not really about the customer, don't really care. We just want to make sure we protect the system.

At the end of it, we might be making the system so difficult that no one can even access it. Nobody wants to take the time, the 45 minutes it takes to set up an ID and jump through all the hurdles to get to an ID. So I think that from a larger standpoint, and just talking on the panel, they admitted that there are a lot of systems out there. A lot of public-facing, citizen-facing systems, and backend systems that need a lot more focus around the customer experience. And again, not just around zero trust, this is just in general about just the basic usability of the system, if that makes sense.

Zero Trust Should Be a User Experience Enabler

Mark: It does, you know, I can't remember if this was in a sidebar conversation after the event or if it was during the event, But they talked about multifactor authentication and how they were almost just forced to take the plunge. And somebody said, "We're just going to do it." At the end of the day, they're like, "Oh, wow. Okay, this word works. It's not that difficult. It's not that tough for end-users."

Carolyn: Well, and do you know what’s funny, is when I hear security, so zero trust is all about security to me as an end-user. And whenever I hear security, that makes me feel a little puke-y. Because I think that means that my experience is going to be really awful as an end-user, to your point, Willie.

However, Willie, you make the argument at the event that zero trust can and should make the end-user, my user experience, better and make the practitioner's experience better. So there's more than one end user. There's the end-user of the systems, then there's me trying to get into the systems, and can you talk a little bit more about that? And did you get the sense that our government speakers feel the same way? That zero trust really should be a user experience enabler?

Willie: Right. So, that's an excellent point. I do agree with that. And I think the panel as a whole agrees with that too.

Again, if you look at the principles, the mindset around zero trust, the mindset around architecture, architecting zero trust framework, it's an all encompassing type of scenario. Understanding Your Customer’s User Experience

Willie: It's not just like we're buying MFA or you get single sign-on and this, this and this, and you've got zero trust. It's really a whole mindset. I think Nicole actually mentioned this. With everything they do, especially with zero trust, they're thinking about user experience at the beginning of the process.

So things like multifactor authentication as Mark already pointed out. When you have a robust multifactor setup, that is going to actually enable you to make your end user's life easier. Because once they log in, once they validate, whatever those multiple factors that they use to validate that user, once that I can trust you or you, and the device that you are on is a valid device, then now you can have access to this cloud application. Or you can have access to this internal system or that authentication token can be passed around.

There might still be a validation process, but it should be external. You shouldn't see it as the customer. It should all be kind of going on in the background. It's constantly validating you. So I think that idea was there, but also I did counter though, the point that, yes, it should be better. But how do you know it's better if you're not measuring it?

If you don't understand today your customer's user experience, how do you know it's gotten better when we implement these new systems? How do you know it hasn't gotten worse? How do you know that there really isn't a problem? I gave an example as part of my keynote.

Monitoring User Experience

Willie: I didn't mention the agency name, but several months ago I tried to set up a multifactor authentication for a system with some of my personal information on it. This was a government system. And after about 45 minutes of filling out a form, putting in my government ID, waiting for an identifying number to come back on my phone, which never showed up. Trying to go back and reestablish and start it over again.

Literally after 45 minutes and then the system telling me to call this number to try to do this manually. I was like, "I'll just go in and do what I need to do." So again, do I think either this agency that I was working with just didn't know how bad the customer experience was, or they just didn't care. And my hope is that it's just they didn't know.

Mark: I think that's probably it.

Carolyn: I think it might be a little bit of both. Because they have to have the security in place. They have to use those systems too.

Mark: Yes but they're typically technical people..

Carolyn: Yes. So is Willie.

Willie: Well yes, but I love the customer, so I always focus on the customer. No, but seriously, that's the one thing. To your point, it might be a little bit of both that and let me take that back. I know from experience, it probably is a little bit of both in that.

Making the User Experience Easier

Willie: There is this idea that, okay, we have to tolerate some bit of inconvenience to allow us to have a secure system. Now, I think what I went through was the extreme.

Carolyn: Is it?

Willie: Well, and unfortunately it might not be, but at the end of the day, there is this idea, you have to tolerate this thing. But I also made the point during the keynote that industry has solved some of these.

Like if you look at the financial sector, for example. I used the example of trying to set up MFA on this government system versus setting up MFA on my bank account. And when I was forced to do that, obviously they had tested this system 15,000 times. Because when I went in, by the time I was forced to go for my really insecure password and I should have better passwords. But I went from that password to having to set up my MFA, I was thinking it was going to be a long process. The bank was about to put me through this long process. It took me less than 45 seconds. It took me about a minute. Most of that time was me waiting for a response back on my phone.

As soon as that was over, now, literally whenever I log in, I get a text message on my phone. I hit a button, I'm logged into the system. Those kinds of things. And I think Jamie even brought up the point that at some point we need to get away from even multifactor and have more biometrics. It should become even easier like we have a thumbprint reader or something like that.

OMB Is Pushing to Move Too Fast

Carolyn: Yes. But I don't want anybody to kill me for my eyeball so they can break into my system.

Willie: Yes, you've been watching too much Netflix. I think that was that Thor, one of the Marvel movies?

Carolyn: I'm sure it's more than one. So there's an article that cites a study, the article is called How Federal Agencies Can Implement a Secure and User-Friendly Zero Trust Architecture. It states that nearly four out of five federal cybersecurity decision-makers, they know there's an urgency. They want to implement zero trust. However, 87% of them say the white house and the OMB are pushing to move too fast. Mark, I know you have an opinion about this. So talk to me about that pushing to move too fast. Are they? Should they be?

Mark: Yes, they should definitely be pushing. I think that the white house has to push fast because I feel like we're probably five years behind where we should be today to feel comfortable. If they don't push, then you're going to have agencies across the government be at different levels of maturity. They're going to be all over the place.

So you're going to have gaps and things like that. If you leave it up to the agencies to go at their own pace, it's kind of like the concept of, you don't need it to be a hundred percent perfect, but you need it to be 75% perfect. Then we'll work on the remainder of the 25% that's not perfect and get it there.

Done Is Better Than Perfect

Mark: So we have to push. It was almost like the way agencies adjusted when the pandemic hit, they didn't have a choice. And they had to deal with remote workforce. They had to do it. They had to digitally transform and modernize and it made them do things out of their comfort zone that I think that they have to do.

So there needs to be a push. I feel like when you hear experts across the government, talk about this, that it's just got to be a very modular, agile approach to doing it and billing it. So that has technology advances and changes and things change that they can pull things in and out. They can move things around and bring things in that work together and that kind of stuff to get to where they need to be.

Carolyn: Yes. Done is better than perfect because perfect never gets done, is one of my favorite quotes. And you just said something, I was going to ask you and Willi. So we think that the white house should push hard. Yes, they're pushing. If they don't, then we're never going to get started. Then you said something about a modular approach to do this well. So is that the sense that we got from our speakers at the summit, is that one of the solutions that we heard from them?

Willie: So I'm thinking, and the modular approach or what I took away from the conversation and also with what Mark was saying. I think it was Jamie who has kind of taken this approach of, we need to use kind of agile development methodologies in this process.

Minimum Viable Security

Willie: In the agile mindset, there's this idea of the MVP, the minimum viable product. This is really something that we see a lot of an industry, kind of getting that minimum built product out there to get into the market. Then start iterating through functionality and fixes and so forth as you find them and improve the product rapidly. Rapid improvement of the product.

I think what Jamie was kind of alluding to was this idea of minimum viable security, where you've got to start somewhere. We can't just plan and nothing ever gets done. But get the minimum viable out there and then start iterating through basically building that framework with a more agile type process. Also this would impact the end-user.

We talked about customer experience. Learning from these first iterations, what worked, what didn't work, how do we make it better? Obviously, you have to make it secure enough. You don't want to just leave the gates open. You don't want to put something out there that is insecure. But we're never going to reach a point where it's just Nirvana, everything's in place. Everything's secure. Nobody's ever going to get into our systems because that's just fallacy.

I mean, this is an arms race. As soon as we find some way to, secure a system, there are hundreds and thousands of hackers out there. State-sponsored ones, people living in their basements, whatever, all trying to break into these systems. So it's just kind of back and forth. So we've got to constantly iterate. We've got to constantly build on what's worked in the past and what didn't work in the past. That's kind of what I took away.How to Ensure Zero Trust Does Not Disrupt the Employee User Experience

Mark: I think those are two things that work against each other. Because I have to imagine there's a tremendous amount of pressure on your average federal government agency, CIO and CSO, to do it right, to plan and make sure it's right. Because some of these agencies, they don't have room for error. We've heard this, not just on the panel at the event, but we've heard this from past podcast guests that some of these agencies, they can't fail. The attacker keeps coming at them and they have no margin for error.

Carolyn: But isn't that why we do like sandboxing and we set up staging servers and we run the scenarios? Let's fail and fail fast and do it in a safe environment that's not out in the wild. We've addressed this a little bit, but what are the steps to take to ensure that zero trust does not disrupt the employee user experience?

Willie: My personal take on it. This is kind of what I talked about in my keynote.

First of all, you've got to measure, you've got to observe, you've got to know what your experience is. So observation and testing. Something we are notoriously bad at unfortunately, and we've seen this time and time again where we don't do sufficient testing of a new product, to the user experience. Like if I'm implementing a new authentication system, whatever it might be, test it, have simulations run quality checks....

This week, Carolyn is joined again by Bob Stevens, AVP Public Sector at GitLab, this time to talk about the power of hyperautomation. Listen in as Carolyn learns what can be gained through fast, accurate application security.

Episode Table of Contents

• [00:32] What is Hyperautomation
• [09:02] What Has Changed in Hyperautomation

Episode Links and Resources

• Bob Stevens
• Malcolm Gladwell: Blink

What is Hyperautomation

Carolyn: I'm excited to welcome back Bob Stevens, Area Vice President of Public Sector at GitLab. Bob is a seasoned veteran in public sector technology with over 36 years of experience.

As the AVP at GitLab, he is responsible for helping government organizations become more productive, efficient, and effective. Bob has experience on both the industry and the government side of things. Prior to industry, he served in the United States Air Force as a computer specialist at the White House Communications Agency.

Today, we are going to talk about artificial intelligence, machine learning, and what hyperautomation is exactly. Why Bob thinks it will be 2022's biggest trend. Bob, welcome back to Tech Transforms.

Bob: I'm happy to be here. Thank you. Appreciate it.

Carolyn: I'd like to talk about an episode that you just did with GovExec Daily. And on this episode, you mentioned that hyperautomation will be 2022's biggest trend. I'm going to be honest. I haven't really heard hyperautomation. And I get automation. I can deduce what hyperautomation is, but I would love for you to explain it to me. What's the difference between automation, hyperautomation, DevOps, all of that?

Bob: Yes, I mean, it's the strict definition of the word.

It's rapidly identifying, vetting in automated processes in order to produce whatever it is that you're working on as fast as you possibly can. And it trends today because if you think about the government space, they have a lot of compliance issues that they need to deal with. The Benefits of Hyperautomation

Bob: If they can automate those compliance processes and ensure that when they build software, in the end it's going to be compliant and they don't have to go back and vet it. I mean, that's going to save them a world of time.

Carolyn: Are you talking about missed compliances, automating some of those missed controls? There's 300 of them, I think.

Bob: Yes, those. I think you're talking about FedRAMP.

Carolyn: Yes. One of. Or authority to operate has all of those. Right? I mean, I don't know all the details.

Bob: Yes, no. There's the STIGs. That the government has to put all software through and that's all about compliance. The government has to get the authority to operate, ATOs, for everything that they run.

Carolyn: And renew them every two or three years.

Bob: Or sooner. It depends on how much of a change occurred in the application. If you can hyperautomate all of that by the use of AI or machine learning. Again, and so by the time you produced that software, all those compliance issues are addressed. You know they're addressed because you've got confidence in the system and the way that it was done. It didn't require as little human intervention as possible, which is unfortunately, where some mistakes are injected.

Then you've saved a world of time and you've made life really, really easy for the folks that are doing the development. As well as the folks that are using the applications in the end. Because they don't have to sit and wait to get the authority to operate, which sometimes can take a year.The Bad News: We Haven’t Tried Hyperautomation

Carolyn: Is the differentiator between automation, DevOps, and hyperautomation really adding in, automating those compliances? And are you telling me that that hasn't happened before now?

Bob: Unfortunately, it has not happened. I mean, that's evident by the fact that the government still has to produce ATOs and they still are doing STIGs at the end of the development cycle. Unfortunately, it hasn't happened.

I think the government will embrace it and has started to embrace it. And therefore, will embrace hyperautomation, otherwise referred to as DevOps automation. Because it's really during the DevOps process that all that automation occurs. But it is going to continue to have focus.

Compliance is just one area. Security is another one. If I can ensure that when I'm done with my software development, it's free of vulnerability or known vulnerabilities. Then again, the developers can help the security folks be more supportive of those applications and getting them out to users faster, rather than having to put them through some other processes or manual processes in the end. Hyperautomation, it's not going to go anywhere. It's only going to build and become more important for everybody.

Carolyn: What's made it a thing now? First, my head's still spinning that we haven't automated a lot of these controls. But what's made it a thing now? Are there new tools coming online or did somebody just go, "Oh, you know what would be a good idea?"

Bob: It's a combination of both. It's the collision of DevOps with compliance built-in. Just having the ability to do that. This gets back to what we spoke about last time, which is the building of a platform, where all 10 aspects of the development life cycle are incorporated into one platform.

Misconceptions About How Hyperautomation Can Be Used

Bob: And now I can start to include things, like ensuring that code is vulnerability-free when it's complete. Ensuring that I've met all compliance requirements during the process, rather than waiting till the end and doing all the tests. It's a combination of both. It's new tools, new capabilities, as well as the fact that somebody said, "Hey, wouldn't it be a great idea to combine these?"

Carolyn: Yes. Right. Why haven't we been doing this in like forever? Are there any misconceptions about how hyperautomation can be used?

Bob: Well, I'd love to say that it's going to be the end-all, be all for everything, but it's not. It never is. And they'll always require some manual intervention at some point or some additional thought that needs to be required. But that just means we get to continue to iterate on it, which is part of the GitLab culture. We put things out in small batches and then we iterate them in order to get them closer to perfection. Rather than wait for perfection before we introduce whatever it is that we're working on.

Carolyn: I think you already kind of answered this, but is there a point where DevOps and hyperautomation overlap? Are they kind of the same thing? Are they two sites? How do they work together?

Bob: Yes. I think there's overlap, which is why I was saying that it's also referred to as DevOps automation.

Carolyn: Yes. It is the same thing, kind of?

Bob: Yes.

Carolyn: Okay. You did the interview just this February of 2022 with GovExec Daily. Do you think much has changed in hyperautomation, just even in the last two to three months?

What Has Changed in Hyperautomation

Bob: I think it has. I can tell you just from a GitLab perspective, you can now use our tool for some of those compliance, automated compliance processes that we talked about.

Carolyn: What kind of lift is that to get, for example, GitLab to make it so the government will accept that automation?

Bob: Yes. That's a good question. You know what? I have not been through that process yet.

Carolyn: But I would imagine you got to do an ATO kind of process on the automation side, so the government can accept it. Right?

Bob: Yes, no, that's true. I mean, they take our software and put it through the ATO process. What tool could you use to put ours through that would give us an ATO in the end? It's to your stacking tools, upon tools, upon tools.

Carolyn: Yes. Or maybe it's just eyeballs on it saying, "Yes, this works."

Bob: Yes. Again, back to our culture. I mean, transparency is key and we're going to be 100% transparent with the government or any entity that uses our technology. And we're going to show them exactly what's happening under the covers so that they're fully aware and can make their assessments.

I already know the government is embracing. Just as an example. I mean, they're required to produce a software bill of materials in the end. Because a developer can pull libraries from anywhere, it's important to build that software bill of materials in order to assure compliance. Well, our tool will build it for you.

AI and Machine Learning’s Part in Hyperautomation

Bob: We'll tell you where all those libraries were pulled from and produce the list. So that you don't have to go back or keep track or do some sort of manual process. I can tell you the government has embraced that. I mean, they want that to be an automated process. They don't want somebody going back through what could be hundreds of thousands of lines of code to figure out where did it actually come from?

Carolyn: Yes. I mean, talk about a security risk, to not know everything that was involved in building it. And then I would imagine, if you've got a tool that builds your SBOM, it's got to be aware as things get updated. The next version of the software, that's part of it.

Bob: Yes. I mean, that's where AI and machine learning really play a major part. Because you're right. We've got to know about every library that can be discovered out there and was written.

Carolyn: My chief technologist, Willie Hicks, likes to correct me when I interchange machine learning and AI. Is one used as part of this process more than the other? Do they both have their place? Because you've mentioned both, machine learning and AI.

Bob: Yes. I mention them because they're part of hyperautomation. I'm not going to tell you I'm an expert on either one of them. And of course, they can often have different definitions or be used interchangeably. I think to answer your question, I'm going to say it depends. Depends on who you're talking to at that particular time.

Blink

Carolyn: That makes sense. Well, we are coming up against time again. I'm going to thank you for your time. But before I let you go, I want to throw some more tech talk questions at you. I won't give you the same tech talk questions that we did last time. Let's go with books. Who was the author that you mentioned last time?

Bob: James Patterson.

Carolyn: Okay. Do you like Tom Clancy too? Sorry. He makes me think of Tom Clancy.

Bob: I have read Tom Clancy. Honestly, he uses too many words, so I don't read.

Carolyn: Right? You can skip a whole chapter and not miss the story. But okay, good. On the same page there. But do you have a favorite genre of books? Is it thriller?

Bob: Well, it is the criminal thrillers. Those are interesting to me because I guess, maybe that's the way my mind works. I'm trying to figure out what the end is long before I get to the end. I think that's what engages me quickly. I also like any leadership book that can help you be better.

Carolyn: Do you have a favorite or some favorites?

Bob: Yes. One of my favorites is Malcolm Gladwell’s Blink. I know people like to go to his Tipping Point, but I think Blink is the best one. Blink is really all about you trusting your gut. Because if you've done something for long enough, you're an expert. Therefore, you should trust your instincts. And I don't think that happens all the time. I think people question themselves and others. And I just think that book does a really good job of leading you towards trusting you.

Intuition

Carolyn: Yes, I agree. I mean, I think that we have an intuition. That intuition gets a bad rap. That it's not knowledge, but it is. It's knowledge that we've built up over the years that I think we can respond to faster than our neat computers that sit on top of our shoulders can compute. We've got that knowledge somewhere that we've gained over the years. And maybe it is even encoded into us through centuries of our ancestors learning to run from the bear.

Bob: Yes. I've heard. For me, it's wisdom. That's what we've gained is wisdom.

Carolyn: Yes. There we go. That's a better word.

Bob: Yes.

We need to trust that wisdom. We also need to impart that wisdom. That's part of our responsibility to our coworkers or our families, friends, whatever, whoever it is that you're engaged with.

Carolyn: Well, great. You've inspired me to go back and revisit Blink because it's been a while. Well, Bob, thanks again for joining us and taking the time to share some insights with our listeners.

Listeners, thanks for joining us. Please be sure to visit the website for the show notes and references that Bob made. We also want to thank our sponsors Dynatrace. Visit dynatrace.com to learn more about how you can literally transform faster, smarter, and easier. Please share and like this episode.

Sara Jones, CEO of InclusionPro joins Carolyn and Mark to talk about all things diversity, equity, and inclusion. Sara explains gaps in authenticity and perception and gives tech leaders everywhere new goals to strive for when it comes to company culture.

Episode Table of Contents

• [00:54] Why We Always Go Back to Company Culture
• [10:38] How Leaders Respond to Employees’ Desire
• [23:03] What Attracts People of Color to Apply
• [30:54] Why Leaders Avoid the Important Things About Company Culture
• [41:37] What Technology Can Never Replace

Episode Links and Resources

• Sara Jones
• Inclusive Research and the Authenticity Gap
• TED Talk: My story of love and loss as a transracial adoptee
• SheTech
• SUU Women In Tech
• Sorenson Communications
• Ariel Alternatives
• Battlestar Galactica

Why We Always Go Back to Company Culture

Carolyn: Today I am really happy to have Sara Jones with us. Sara's a friend and we've spoken before. Almost all of our guests, even though we're talking about tech, they always go back to culture. We're going to talk about that with Sara today.

Sara Jones is the CEO of InclusionPro. She has over 20 years of experience in technology, business development, law, and leadership. You were a practicing attorney, right Sara?

Sara: For 10 years. I'm still recovering.

Carolyn: So as the CEO of InclusionPro, her mission is to guide leaders in building inclusive company culture that promotes team performance and team innovation. She's written a book recently called Inclusive Leadership and the Authenticity Gap, that we get to talk about today.

Sara: Thank you. And this is a fun opportunity for me to merge my love of technology with diversity, equity, and inclusion. As most folks know, it is pretty hard to do. I've had a couple of decades talking about this, so hopefully, we can share some really great learnings. Most importantly, I think for the folks listening that might be thinking "DEI again."

Carolyn: Which stands for?

Sara: Diversity, Equity, and Inclusion. A lot of things have shifted. I think a lot of folks come to this type of conversation with the old thinking in mind. I'd just like to invite listeners to get rid of what you know. Just be open to hearing some new thoughts around diversity, equity, inclusions, and things that we're able to do now that we weren't able to do even five years ago. That's my little plug for saying, "Open-minded today?"

InclusionPro

Carolyn: That leads really nicely into my first question about being a recovering attorney, your love for tech. What inspired you to create InclusionPro?

Sara: InclusionPro is the end of a long 20-year journey having diversity, equity, inclusion as part of my personal career journey. Now, it may not be part of everyone's and a significant part of that is because I did start in patent law. Having an engineering degree and a law degree, put me in an industry that had only 5% women and people of color. I get a lot of people that are like, "Oh, our industry has no women." I'm like, "Yes, I've been there."

I actually know what it's like. It's not like I came from academia or some area that was just flushed with a lot of diversity. I have lived this and I understand the impacts of it at a very personal level. But I also have been an executive. I know the challenges of being an executive, those operational aspects and how it really works in business.

There's some big misalignments that can happen that we need to talk about when we get to this idea of authenticity. What is the individual need versus the larger organizational needs? Those can be very complex, very hard. I think it's something unique that I've been able to understand over my time. That makes me uniquely positioned to be able to help executives in this journey where most of them haven't been in this conversation.

I think white men are more recently joining the conversation, which is very exciting. But you got a lot of employees saying, "What about social justice? What about this? I'm not seeing this statement. Where's this ERG, where's this, you're not committed."

How Company Culture Makes It Challenging to Be a Leader

Sara: It can be really challenging to be a leader. Being able to frankly, make a full-time living, doing diversity, equity, inclusion, it's not something I could have ever imagined would've happened 20 years ago. Happily, here we are and people are willing to invest the time and energy into doing this. I'm just thrilled that I can do this full-time and bring all that knowledge into the companies.

Mark: I'd really like to understand what you think that means and what we're doing. I was a little confused at first by the use of authentic or authenticity here.

Carolyn: I'm really interested to know what it means for the employee, for us, for me and why it matters to the bottom line for the company. I think a lot of times, that's what creates change. If it helps the bottom line, then we'll do it. I don't know if there's a tie in there.

Sara: What's interesting is that's actually the number one thing that executives want. When I work with an executive team, we actually go through an exercise that asks them, "What is the thing that you most desire out of all of these strategic outcomes?" So think about that. That's not actually a bottom-line conversation.

I, as an executive and a leader, would really like to be able to do this. It’s not because it's what we've always been saying is the right thing to do. We all know that. Let's just move forward past that because people aren't doing it. At the core, what I find is when you get leaders in a space where they can be self reflective, they actually just want to be themselves.An Angel Double Position

Sara: It's so bizarre, but they want to be humanized too. They want to be able to try, and if they may make a mistake, executives get this kind of spotlight on them. We can debate the word unfair, but they have a spotlight on them. Even if they make a small mistake, people are going to notice and be like, "Those people, they don't get it. How can they be so disconnected?" Et cetera, et cetera. Imagine what that starts to do as leaders are trying to learn.

Let's say you're a white man. You've recently started learning about diversity, equity, inclusion, and you have folks that are expecting you to be perfect at it. That's a lot of pressure for leaders. By the way, I'm not perfect either. So we've created this interesting dynamic, not necessarily recently, but I think for leaders having to be on guard and in this angel double position.

Mark: Maybe more so for publicly traded companies.

Sara: Yes, public, but even private companies. This is any culture where leaders have this pressure.

Carolyn: Even government, I'm thinking about our defense leadership. I feel like they almost can't afford to be authentic.

Sara: That's exactly right. Now you're thinking about the give and take of what I am allowed to say. Do I have the freedom to say? How do you shift that? What happens is when you really curate the words that you say, you actually stop communicating. You stop having conversations with people and say, "If that's the reaction I'm going to get, I'm just not even going to try."

How Human Connection Stops in the Company Culture

Sara: So the learning stops, the engagement stops, the human connection stops in the company culture. That's been the whole problem to begin with. If we would just get together in a room, sit down and be able to have conversations, actually knowing and expecting people to make mistakes. Then how do we help people through that and help each other learn?

By the way, it's not just white men that are going to make mistakes. It's going to be people of color to make assumptions, it's going to be, LGBTQIA identifying people. We're all going to make mistakes because we're all human. We've created this interesting boundary around what's permissible and what's not permissible. It's really slowed down our ability to change culture within leaders or companies.

Now, what I'm not saying is say whatever you want, that's not what I'm saying. What I'm saying is that authenticity, the goal to reach that is really a journey. It's really like "We're going to help each other. We're going to learn side by side, because I, as the executive, don't know everything. You, as the new employee don't know everything either and it's okay, we're going to help each other out."

Now it's more of a partnered experience rather than what would be considered a top down. The leaders need to model or grassroots because neither works by itself alone. That's an example of the shift that enables more people within an organization to really be more authentic and reduce the misalignments that can help.

Carolyn: Is the authenticity gap more in the leadership or in the employees or everybody?

How Leaders Respond to Employees’ Desire

Sara: I would say it's how leaders respond to employees' desire for more inclusion. There's actually many options available to leaders. If they are not in touch with the way to get that true connection with their employees, they're more likely to create an authenticity gap. They're more likely to have people say, "They're doing it to check the box. They don't really mean it. They're doing it for marketing reasons, but they don't actually believe it." It's that sort of sentiment that you're trying to reduce. There's methods that produce that and there's also methods that create more authenticity.

Carolyn: I absolutely see how being authentic is good for your soul. Is it good for your company?

Sara: Yes. We're in the great resignation period. We have had some pretty rough business experiences. I think executives are just scrambling right now to figure things out. Some are saying, "I can't afford right now to do diversity, equity, inclusion." In my mind, if you're thinking of diversity, equity, inclusion, as something on top of your day job, you're probably thinking about it wrong in the first place.

It's really how we show up, how we make decisions, how we grow the business. It is not about just keeping employees happy. If you're just trying to satiate employees and that's very patronizing and it is felt, they know. They're not dumb. They know when leaders are just doing it to make it seem like they're doing it, but they're not really committed. The teams I work on usually have very genuine interests. I'm actually not working with folks that are just talking the talk. If they're talking the talk, I guarantee they will not hire me.How to Make an Impact

Sara: That's just a fundamentally easy thing for me as a DEI consultant, to know who's genuinely committed, who wants to do the work, and who's not interested in doing it. My day-to-day is really more focused on those organizations and what they can do to make an impact.

I'm actually seeing the work going on inside of the organization. Some of that's a little bit more invisible to folks on the outside. That's the leadership challenge right there, it’s that communication piece and things like that. I don't necessarily go and approach, and says, "I look at the executive team or boardroom and I'm diversifying now”. You're going to get a lot of backlash."

That's absolutely not my approach. From an executive leadership standpoint, we know how hard it is to keep the ship running. Having a lot of changeover at the top is just not smart. So what is the learning, the growth and cap, and capacity we start to build on the leadership team so they can start to make decisions in a more deep, inclusive way? That's when you're going to start to see the real authenticity happen.

Sometimes it takes a year or two for change to happen. So if we're looking for immediate change, again it is reactive. What I'm trying to do is get folks to move from reactive to intentional. Again, we went from decades of "Let's invite a woman to speak and talk about her gender". How much did that make us mad? We're like, "Oh my gosh, I have a brain. Please let me showcase my talents, not talk about what it's like to be a woman".

A Company Culture Where a Person of Color Can Thrive

Sara: We want the same thing as men. It's not really that different, the things that I want for my career versus what a man wants in his career. So whether that's a person of color or anyone, we've got to get people better at seeing genius in a wider range of forms. That's the learning that leaders have to do. It’s to be able to say, you know, cybersecurity experts, don't just look one way. They don't talk one way or solve a problem one way, they actually solve it in a lot of different ways.

If they don't have that exposure, if they've not worked with a group of diverse thinkers, they're very unlikely. They're much more likely to hire, like if they really want to diversify, somebody based on an optic characteristic rather than an internal skills. It is ultimately the right way to hire whichever anyone wants.

Mark: How do we get more women and minorities involved in STEM early? By the way, getting people involved in STEM early doesn't mean that in a year you're now seeing results. You're probably seeing results a decade later. Something that I'm struggling with, as our company at Dynatrace grow, we are looking for diverse candidates that we would like to hire. I'm looking at the candidate pool and I see a disproportionate amount of white males in the candidate pool in technology.

I don't know how I can change that. It's significant. I've worked at companies in the past who are heavily involved in STEM and things like that, but I don't feel we're seeing the results of those efforts in the marketplace now. Maybe we will, and I'll be out of the marketplace by then.

The Truth About Company Culture and the Talent Pipeline

Sara: It'll be a decade from now, but how do I handle and deal with these kinds of things that I have to deal with today?

Carolyn: What Mark sees anecdotally, I'm guessing that's pretty universal. On the flip side in the marketing world, even though I'm in tech, when I go to hire, most of my peers are women, which I find very interesting. I would say 80, maybe 90% are women.

Sara: Here's a couple of thoughts and I guess I'll just get real honest. It's interesting because I've been doing this work for 20 years.

The observation of the talent pipeline is very common and it is actually not true. What typically that comment comes from is a lack of self reflection on the company culture. Just because you are not getting candidates means candidates don't want to apply to you. That's just the end.

People are like, "What, why wouldn't they? We're awesome." If you're awesome at hiring white men, good for you, A+. But that's where the perception gap comes in. You actually fail at hiring women, you get an F. This is where the leaders have to sit down and start to get really honest with themselves because my network is full of women in tech, full of it.

So anecdotally, I could sit here and say, "I actually know hundreds and thousands of women in technology. You don't know any? So, who's right and who's wrong?" We both have our life experiences. It's just that I've made the intentional work and decision to include in my personal network, a lot more women in tech. They are there. You just haven't done the work to build your network. So that's the moment of honesty.

Authenticity Gap

Sara: Now this is where the authenticity gap comes from. I can say that as an outside consultant. Unless you listen and hear that, and accept the ownership and responsibility instead of deflect and say, "Well it's because the talent pipeline isn't full, instead of, "Wow, we are not getting women applying to our company. We are doing something wrong. We're actually really great at targeting white men."

I've had people say, "I don't want to change things because I just don't believe in targeting women and people of color." I'm like, "You're already targeting white men." That is an interesting statement if all you're hiring is white men because the talent is there. It's just, are you willing to do the work to find it and really bring it into your network in a meaningful way?

What happens if you watch the research, people will make a decision before they ever hit the submit application button. Just because you are not getting applicants is not a reflection at all of the true talent pool. Leaders somehow have decided that, "Oh, well, there's nothing I can do because there's just no talent out there.

Mark: I see your point. It's probably up to me to be more active in that process. As I was thinking through your explanation on this, we have an internal resource, a talent recruiting team. They're the ones who get the candidates and bring them to us.

Sara: The talent decides to go where they can thrive. If you think about that, why are they choosing not to come to your company? There's something about how you're describing or the interactions where they can't get that sense of thriving.

Strategic Risk Management

Sara: It is actually a strategic risk management skill if you think about it. So I have a law degree and an engineering degree. I'm not s**. What we're doing is, we're looking at these cues that companies are giving off.

We're making a risk management assessment of "Is that where I want to spend my time and energy? Is that where I think they're set up to actually help me thrive? Do I really feel like it's going to be an emotionally exhausting place to work?" Because "No, thank you. I'm not even going to hit apply."

BYU did some interesting research where they had job postings and they had one job posting that said, "Was very neutral." They had one job posting that said, "We really encourage people from all backgrounds, diversity, please apply." Then they had another posting that talked about their inclusive culture. Now I'm not saying this exactly right. You know, but Mark, which one do you think got the most submit application clicks? They might not have gotten hired, but they got the most submitted application clicks.

Carolyn: What are our choices again?

Sara: Neutral. We want all these types of diversity, please. If you meet these diverse identity, care characteristics, please apply. Or the third one is, we have a mission and inclusion. It’s a really important part of our culture and more of that type of statement.

Mark: I would assume the latter.

Carolyn: Me too. The third one?

Sara: You are right. It got more applicants. This is actually a Goldman...

Join us on Tech Transforms Federal News Round-up segment, So What? Hosted by Carolyn Ford and Tracy Bannon. This week, we talk to Elizebeth Varghese, Global and Americas Leader – HR Transformation Client Offerings at IBM about one of the biggest topics in federal news: remote work. Listen in to find out how agencies can implement a smarter protocol, how remote work impacts the trust equation and the role technology can play in the workforce culture.

Episode Table of Contents

• [00:40] The Future of Work for Federal Employees
• [11:28] Work-Life Balance Expectations in a Remote Work
• [19:01] Big Push in In-Person Protocol
• [26:12] Do You Need a Home Office for Remote Work?
• [32:01] Provide Options to Persuade People to Stay and Junk Remote Work
• [39:04] The People Who Are Not Approving Remote Work

Episode Links and Resources

• Elizebeth Varghese
• IBM
• South Asian Youth Action
• Three Ways the Future of Work Must Change for Federal Employees
• Hybrid work for many is messy and exhausting
• Welcome Back to the Office. Isn't This Fun?
• Thousands of employees are testing a 4-day workweek starting today: ‘It’s inevitable we’ll see bigger companies doing this
• Super Better by Jane McGonigal
• [Block] Chain Reaction

The Future of Work for Federal Employees

Carolyn: This month, we're hosting Elizebeth Varghese, Global & America's Leader: Client Offerings in Talent and HR Strategy at IBM. And outside of IBM she's an active board member at South Asian Youth Action, a nonprofit providing after-school programming, education, and college support.

She was recognized as Global Top 100 Influencer in HR for 2020. And we are glad to have you joining us today, Elizebeth, to discuss returning to the office, the great resignation, and companies potentially switching to a four-day workweek hybrid, all of that. Welcome Elizebeth, how are you?

Elizebeth: Great, thank you so much, Carolyn. Wonderful and delighted to be here. Great to be back on here with Tracy as well, friend from a couple of years ago as we've been going through some of these pandemic podcasts. So thank you for inviting me and I am looking forward to this.

Carolyn: Yes, well this one's going to be a fun one and it might get a little heated. I've already seen some stuff on LinkedIn. I'm like, oh, that gets my blood boiling about returning to the office. And I want to start off with a question, there's an article called "Three ways the future of work must change for federal employees."

The article states that at the end of the day, we need to have an IT and HR Alliance. This was due to exceptional communication between the agency's chief information officer and HR functions. In your experience, is the relationship between IT and HR something government agencies need to improve on? And industry too?

Does the Relationship Between IT and HR Need Improvement?

Elizebeth: Now what we've seen, the pandemic is highlighted so nothing new. This was happening for a while. I have to preface it with that. Because I think in lots of our conversations we hear this thing about, hey, this is what the pandemic caused.

The pandemic caused a lot of suffering and hardship for many people, but it highlighted things that were in play for many years. And the fact the intersection of HR data and how IT's using it and accessing it has been an eternal problem. It's been going on for many years.

But things came to a head when we were forced to be virtual in the federal sector and in the commercial sector. People realized that that intersection hadn't really been explored. It hadn't been addressed. It hadn't been managed in a sufficiently coherent fashion.

There were a couple of reasons for that and some folks in the federal sector or commercial, the reason I say that is because this is a universal problem. It's not endemic just to one sector and we should take that. But when the pandemic hit, there were lots of tropes. Even before that around what can be done remotely, what data can be accessed in what fashion, what is secure and not.

What the pandemic highlighted is that those issues were not really based upon real cybersecurity issues or access issues or single sign-on issues. They were really managed or impacted by cultural constructs of where work can be done.

A great example of this is if you think about our friends on Wall Street, you could not do investment banking or trading from remote work. It's impossible. There were so many reasons for that, all of them good.

Subcultures and Subgroups During Remote Work

Elizebeth: But come March 15th monitors were shipped to basements in Westport and patios in Westchester county and Wall Street just continued. So we really found that it wasn't, can it be done? It was more of do we want it to be done?

I think that is the question that was highlighted through the pandemic in the federal sector as well. Are we really understanding what technology can do and are we using it to really manage HR data? So that's kind of what I've seen. Tracy, would love your thoughts too. I know you've been working at this intersection for a while as well.

Tracy: It struck me as strange when the pandemic hit because I've had remote teams. I think it was 2009, 2010 was completely remote work with global teams, everybody geographically dispersed. So it was first nature to me, but I never realized with other IT workers how much they did not get that opportunity.

So when we got into the pandemic and I realized different organizations. I changed my job just before the pandemic and what I was starting to realize is how campus-centric or office-centric some of the cultures could be.

Even inside a big organization you can have subcultures, subgroups that really do form these tight bonds. Whether it's going out to lunch or whether it's meeting up at the water cooler or what have you, there is or was this sense. It was a cultural sense that they built together. And that was hard for them, hard for everyone to learn, how do I emulate that? How do I replace that now that I am on remote work?

How People Collaborate in a Remote Work Setup

Tracy: So Elizebeth, if you and I are going to walk to the water cooler and we were going to make a deal or we were going to talk about something or some new topic that we want to research, how did people do that? Or how did they start to do that during the pandemic? What did some of the research show on how people are engaging now?

Elizebeth: People have engaged, as you said, remotely even before the pandemic. There were virtual teams and there were lots of collaboration tools. But I’ll give you an example. The experience that I have as an IBM employee, much like you Tracy we have employees all around the world working on very complex things.

People without having ever met each other or worked in the same room and that was really happening through technologies. Whether it's Slack or chat messages or online Wiki forums. Or what we call Lighthouse at IBM where we share intellectual capital. There were lots of different ways people were connecting.

So what happened in the pandemic is that the companies that had some of the cultural constructs around it is okay to engage that way. Or it's common to make friendships or have friendships evolve over distances and remotely, found that they just moved seamlessly into that.

The companies that struggled with that, again, were less about having the technology and more about people being used to engaging, forming relationships, forming friendships and collaborative pods without technology.

The Question to Ask to See if Remote Work Can Be Done

Elizebeth: So again, it's less about the technology and more about how we work together. And I think we see this, I have teenagers, now they're used to texting versus making a phone call. Now if you are used to texting, it's a lot easier to never have a phone, you don't need the call function. So it's really a habit, it's a way we think about how we communicate, how we are comfortable communicating. I think that is a learned behavior.

So I've learned to text more because I have teenagers. I call them when I need to but you get my drift. I think similarly in organizations, if you're able to provide different channels and different ways of access, we find that people actually learn and embrace them. They do make deals, they plan vacations without having met each other.

We've had experiences where we had kids come in fresh from undergrad or grad, working together in collaborative pods using technology, planning ski trips. Never met each other but a great group that works together. They're all partnering and operating as a team.

So it can be done. The question is who chooses to be in that situation? Or who's comfortable with that kind of maybe job interview process? Lots of people are taking jobs in the pandemic and after without ever physically meeting their teams. So I think that would be my challenge to all of us, not the why but the why not? Why can't we do it?Technology Etiquette in Remote Work Setup

Carolyn: So I'm like you, Tracy, I've worked remote. I live in Utah and I've supported teams that support the federal government for the past 15 years. So I've worked remote since 2010. Most of the time going into the office occasionally which I always said, when I went into the office, those were the days I didn't get anything done.

And what was interesting for me, so this comes back to the culture thing, when everybody went remote was the abuse of the technology. What I mean by that is I felt like we needed to train ourselves in etiquette. Don't text me at three o'clock in the morning. I had to train myself. That's my responsibility to make sure my phone is on silent, do not disturb when I go to bed.

But also I was so good and am so good at getting in the zone and really focusing. The Slack messaging and stuff, I nearly lost my mind when everybody went remote. Because it was constant barrage, constant interruption and there was no time.

You had to get into the zone, into the flow. And it's definitely gotten better, but what do you think about that? Elizebeth first, do you have anything to say about that? And then Tracy I'd love to hear your thoughts.

Elizebeth: That's a great example because actually personally I have the same experience and I think lots of my clients do. Because one, if you're across different time zones, everyone's Slacking you when they're working. So I had to learn, me personally, I had to turn the notifications off. I had to discipline myself to not reply in the moment, but wait and even if I looked at the texts. Because I couldn't bear to not look at it, but tell myself not to.

And in some instances I think also, be cognizant. That sometimes we are responding or we are sending a text because I don't want to forget I'm working now and I make a note of it. But the person at the other end is receiving it and thinking, oh my God, I have to reply. It's an unseen, unexpected pressure that we may not be conscious about. Because we are not doing it to get a response back.

Work-Life Balance Expectations in a Remote Work

Elizebeth: So I think some of those things again require a different way of working. Like you're saying, when do we turn on, when do we turn off? And how much do we really listen to the implications of really having a remote workforce? Both in terms of whether you're in a different time zone or different work-life balance expectations.

Tracy: For a long time I have counseled those coming into their careers to be very specific about when they answer emails. Now I know that the first time that they get their corporate phone and it's connected that they're looking at it.

I realized that I had a responsibility to not send weekend emails. As a leader, they were immediately responding and I realized that I also had to train myself. Now I still do queue things up when I have time. I have had the blessing of being able to have some latitude with I'm going to focus a little bit more this evening. Because I'm going to go and do something with my daughter tomorrow morning. Had some flexibility.

So I have also trained myself to be very specific in my emails. I'm sending this tonight, please don't read or take action till tomorrow. I let them know this is not a rush. If I need somebody, they also know that I'm like a bloodhound and I will find them. We will get ahold of each other if it's truly something that is that much of an emergency.

Tailoring Remote Work Culture to Team Dynamics

Tracy: But you brought up another good point. Prior to the pandemic, except for very close work relationships, those work spouses, I did not text with anybody in the workforce. I would Slack, I would use any of the other tools that were available to me but not that.

When the pandemic started, I have two phones now. I never thought that I would be the two phone person. The work phone and the life phone. But I do. One of the reasons that that has become important is the ability, to your point Carolyn, to turn it off and put it over there because I'm now leaving this part.

Now that all sounds like that I have a really great division between career and life. For me, it's very intermingled, I'm thinking about it all the time. And so if I know that Carolyn is thinking about it. I might feel okay sending you a Slack message or a text message at six or seven at night. This is when I know that you're out there taking a walk or something.

So there is a bit of tailoring after you learn just the culture of it, your individual teams and people. But it's not coming in with rigid expectations, you've got to build that together because each team dynamic is so dramatically different.

Hybrid Work Model

Carolyn: Yes. So I want to talk about, the push now is people coming back to the office. So we talked about this already a little bit and there's a bunch of different models that are being proposed.

I want to talk about the hybrid work style first. There's an article, it's called "Hybrid work for many is messy and exhausting." And we'll put links to all of these too in the show notes. But it says that about 60% of offices will adopt a hybrid work policy this year. So Elizebeth, what policy changes have you seen within IBM or otherwise surrounding the hybrid work model? It sounds like you guys were already hybrid, to some extent.

Elizebeth: Our IBM HR folks are the best folks to answer this question. They've done amazing work over the years for a truly hybrid model because we've had different variations and policies.

What we've seen across the board is that organizations are making different kinds of policies. We have seen a trend definitely around the organizations that traditionally did not like remote work. Lots of organizations in financial services are expecting people to be back in the office. Expecting people to be back for a defined number of days and a defined set of days.

So people are being quite prescriptive about that, so we're definitely seeing that. And as we've seen in the news, there's also been quite a bit of pushback on some of those prescriptive policies. I think some of that is going to continue to evolve. I don't think that has been completely sorted out.

The Optionality of Work in Every Industry

Elizebeth: Now I think in the case of the federal government and really honestly every industry, what we're finding is that the optionality of work has increased. We've seen this in news. The smartest kids who were looking at going to become bankers in a particular well-known organization. I won't name. They are maybe thinking, you know what, I don't really care as much for the hours of work and the expectation that I will be in the office so I'm not going to do that. I'm going to go to a startup.

Now that plays out in the federal government as well. It has for many years in terms of how do we compete for the best talent? And there's a reason the government does need the best and brightest for practice of national security or science and space exploration, a variety of things.

The pivot has really then come to be more around, what's the best way to attract the best talent in our industry? And that's becoming the lens by which policy making is happening.

So the one other thing I just wanted to mention, there's an organization again I won't name. But as they looked at the variety of labs that they had across the country, pre-pandemic everybody had to be in the labs doing their work in their teams. But the pandemic required them to obviously be remote and the serendipitous outcome of that was that they found there was a lot more cross-pollination and sharing of information and collaboration across labs which they hadn't had historically. Because people tended to work with their own physical teams.

The Real Estate You Need to Give Up for Remote Work

Elizebeth: I say that because I think organizations have recognized that there's been much good to come out of the remote work and that the return to work answer is not a simplistic one of just get back into your offices. I'm curious to see what you both have seen too. It's really been an evolving strategy for most people, I think.

Tracy: I think that quite a number of people are asking why. If I'm interviewing with you or if I already work with you, just talk to me about the why. Some firms and some government agencies have a tremendous real estate footprint that they own, that they're not renting. They can't give that space up. So if you own that and you have a dramatic dependency on that, what do you do?

We're seeing that with higher education right now as well. They've got huge campuses and they found out that we don't necessarily need all the students on campus. What's the balance, what's the change off between it?

So I'm finding as we're interviewing, when we talk about work styles, when we talk about hybrid, when we talk about the possibility of being a full teleworker, that's the government term. It came around, I think it became law in 2010 that you could be a teleworker if you could show productivity.

Big Push in In-Person Protocol

Tracy: But as you are trying to talk it through, there are so many people asking me, well, what is the advantage that I have of being in person? What's the advantage that we will...