In a new video series, “Breaking Through for Mission Advantage,” federal and industry leaders share their insights on how the strategic shift to integrated, software-defined IT platforms helped or will help agencies achieve greater mission outcomes.

The Defense Logistics Agency, under the guidance of Chief Information Officer Adarryl Roberts, is spearheading a digital business transformation initiative to streamline efficiency across its supply chain operations. This initiative includes various projects designed to leverage technology to improve the distribution, disposition and supply of critical materials ranging from subsistence goods to construction equipment. By embracing automation and developing a citizen developer program, the DLA enables operational innovations, directly impacting the speed and efficiency of its services.

Similarly, the Navy’s integration of a software-defined approach into its combat systems, highlighted by Cindy DeCarlo, director of global government education and national security at Cisco, signifies a shift toward more agile and secure defense operations. The approach facilitates quick adaptation to mission requirements and ensures enhanced security by consistently enforcing advanced security controls across the infrastructure.

Furthermore, the IRS’s technological overhaul, as shared by Kaschit Pandya, acting chief information security officer, illustrates the transformative power of IT investments in public service delivery. Modernization efforts have led to significant improvements in taxpayer services, including faster refunds, reduced call wait times, and heightened cybersecurity measures, showcasing the tangible benefits of embracing digital transformation.

At the General Services Administration, Ann Lewis, director of technology transformation services, highlighted the complexities of infrastructure modernization, including the importance of making hard choices about system features and functionalities during the modernization process. She advocated for a platform approach to overcome the siloed nature of government systems, stressing that it enables better scalability, simplifies user experiences and ultimately leads to more sustainable system costs.

In the DOD, Rob Vietmeyer, chief software officer, and Dave McKeown, deputy CIO, talked about software’s transformative power and cybersecurity modernization. Vietmeyer focused on the agility and operational efficiency gained through cloud computing, illustrating the department’s push toward rapid deployment capabilities and a more innovative operational approach. McKeown outlined key initiatives in cloud adoption, DevSecOps and zero trust architecture to combat advanced threats and ensure system resilience. 

The strategic shift toward integrated, software-defined platforms is not just about enhancing operational efficiency; it represents a fundamental rethinking of how federal agencies operate in the digital age, ensuring they remain agile, secure and capable of meeting the nation’s needs.

Other participants in the video series include:

• Mary Martinez, Senior Director of Sales, Federal Civilian, Cisco
• Karlie Wilson, Director, DOD, Cisco
• David Raffetto, Director of Sales, DOD, Cisco
• Kevin Manwiller, Operations Director, DOD, Cisco

This video series was produced by Scoop News Group, for FedScoop and sponsored by Cisco.

The post Federal leaders share strategies for mission-critical modernization appeared first on FedScoop.

The counterfeit devices had “numerous performance, functionality, and safety problems” and their failures caused “significant damage to their users’ networks and operations – in some cases, costing users tens of thousands of dollars,” the DOJ said.

The disclosure that the military and government were among the customers of equipment was included in the DOJ’s announcement that Onur Aksoy, 39, pleaded guilty to the operation in the District of New Jersey on Monday.

The DOJ didn’t immediately provide more information about the purchases by the government agencies and military. The release didn’t include details about which agencies purchased the fraudulent equipment.

Aksoy, who is a dual citizen in the US and Turkey, was the CEO of at least 19 companies based in New Jersey and Florida, 15 Amazon storefronts, and 10 eBay storefronts that sold the counterfeit goods, the DOJ said. Those companies and storefronts were known collectively as the “Pro Network Entities.” 

The scheme operated by importing “tens of thousands of low-quality, modified computer networking devices” from China and Hong Kong that were made to appear new with counterfeit Cisco labels, documentation, packaging, and software, the DOJ said. 

“The Chinese counterfeiters often added pirated Cisco software and unauthorized, low-quality, or unreliable components – including components to circumvent technological measures added by Cisco to the software to check for software license compliance and to authenticate the hardware,” the DOJ said.

The department estimated the total retail value of those devices was in the hundreds of millions of dollars. 

Cisco asked Aksoy to cease and desist trafficking the equipment in seven letters sent to him between 2014 and 2019, the DOJ said. Askoy’s attorney responded twice with forged documents. 

Askoy pleaded guilty to mail fraud and “conspiring with others to traffic in counterfeit goods, to commit mail fraud, and to commit wire fraud.” 

His sentencing is scheduled for Nov. 6 where he’ll face four to six-and-a-half years in prison, under a plea agreement conditionally accepted by the court Monday, the DOJ said. He will also forfeit $15 million in gains from the scheme and pay back victims in full under that agreement. 

A Cisco spokesperson said: “We are committed to protecting our valued customers and legitimate authorized Cisco channel partners and maintaining the integrity and quality of Cisco products and services. We thank our colleagues in U.S. law enforcement for their investigative actions, the successful indictment, and the work that led to today’s outcome.”

They added: “The Cisco Brand Protection team also appreciates the strong collaboration with Amazon’s CCU for jointly making the criminal referral that brought this individual to justice.”

Director of Amazon’s Counterfeit Crimes Unit Kebharu Smith said: “This guilty plea sends a strong message to bad actors that selling counterfeits has severe consequences.”

He added: “We are grateful for the collaboration with Cisco and the work of the U.S. Department of Justice to bring this counterfeiter to justice.”

Editor’s note, 6/8/23: This story was updated to include comment from Amazon.

The post Agencies, military among customers hit by scheme involving counterfeit Cisco equipment appeared first on FedScoop.

Defense and intelligence community leaders working to improve security resilience and remain operational during disruptions should consider the full capabilities of next-generation firewall (NGFW) solutions, says a new report produced by Scoop News Group, for FedScoop, and underwritten by Cisco.

Because organizations have acquired separate security tools over time, they have added a lot of complexity to their suite of solutions. NGFW can now provide interconnectivity between firewalls, intrusion detection systems, intrusion protection systems, workload security, endpoint security, threat intelligence and encrypted traffic analysis.

“I remind people that there are over 3,100 U.S.-based security vendors — tens of thousands across the world — and while I will never argue against the necessity of a security tool, I do stress that at some point, these innovations need to either work with something else or be bought by somebody,” explained Chris Crider, security systems engineering leader at Cisco. “At some point, leaders have to make choices on how to best implement security in their environment.”

DOD and IC communities aren’t alone in this challenge. A recent study, produced by Scoop News Group, asked 165 prequalified federal leaders about the state and strength of their current security posture.

More than half (55%) of respondents reported that their security tools function moderately to completely independently from their suite of solutions. And 33% said their organization uses between 11 to 40 different vendors across their security technologies, while 11% use more than 50 security vendors.

But changing the way organizations defend the perimeter is a sentiment that defense leaders are echoing. In a recent FedScoop interview, James “Aaron” Bishop, CISO for the Department of the Air Force, spoke about the challenges of defining the network perimeter and how the Air Force is securing their substantial IT environment.

Bishop referred to the Air Force as operating “150 little cities around the world,” which encompasses a vast IT infrastructure with technology running on different lifecycles that need to be upgraded, maintained, patched and replaced.

“But as a warfighting mission,” he explained, “I also have to extend that capability beyond that base. So now my networks have to go into expeditionary communications, extended aerial networks, etc. Now I need to understand where that perimeter is, where do I protect it [and] where do I pass it on to the next environment that may or may not be there today or tomorrow?”

Leaning into NGFW allows organizations to adopt dynamic packet filtering and policies that travel with applications as they move across a global infrastructure.

“That means that DOD and IC organizations can build and implement policies and additionally utilize security group tags to specify the privileges of a traffic source within a trusted network. Then migrate into any cloud to provide services globally and take the analytics and logging to monitor traffic with a single pane of glass,” added Norman St. Laurent, cyber security specialist at Cisco. “With NGFW, organizations can always monitor what is happening on the network, have a holistic view of activity and full contextual awareness to see threat activity across users, hosts, networks and devices.”

The first important step is finding the right partner to begin integrating security solutions. According to Gartner, organizations should look for some of the following key capabilities when implementing an NGFW:

• Standard firewall capabilities like a stateful inspection.
• Integrated intrusion prevention.
• Application awareness and control to see and block risky applications.
• Threat intelligent sources.
• Upgrade paths to include future information feeds.
• Techniques to address evolving security threats.

Read the full report and learn more about integrating a firewall solution that will adapt to your organization’s evolving network needs.

This article was produced by Scoop News Group, for FedScoop, and sponsored by Cisco.

The post Building security resilience across global missions with next-gen firewalls appeared first on FedScoop.

In a new video series, government leaders shared how their organizations are keeping pace with security demands. The series, “Security Heroes: Defending the Dynamic Perimeter,” was produced by Scoop News Group, for FedScoop, and underwritten by Cisco.

A modern, or hybrid, network perimeter should now include next generation firewalls, policy enforcement points and capabilities like zero trust exchanges, according to Bobby Holstein, zero trust architect for the Bureau of Labor Statistics.

“It’s not the volume of traffic that’s increasing per se, but the complexity. Operations departments will need to increase visibility into these complex traffic flows to be able to monitor performance. And this new secure sharpened edge that’s replacing this [traditional] firewall perimeter needs to be able to inspect SSL traffic for malicious content,” he explained.

Aaron Bishop, CISO at the Department of the Air Force, echoed that sentiment, adding that modernizing perimeter defenses aligns with both cloud and zero trust architecture strategies.

“Firewalls and packet inspection is a key aspect to layers in defense,” he says and determining where the boundary lays “is now the question of the hour” for most leaders.

“I challenge all of my authorizing officials to look at where’s the boundary I’m trying to protect and where is the data that I’m protecting within it. If I need to move that data, I need to understand where that protections go with that data,” shared Bishop.

Many of the government leaders interviewed in this series said that new perimeter defenses need to be more agile to enforce policies across modern infrastructure that includes micro-segmented workloads, encryption needs for data in transit and capabilities like secure access service edge.

Peter Romness, cybersecurity principal, CISO advisors’ office at Cisco, refers to modern firewalls as “security facilitators.” He explained that they have “become a container for security tools—things like antivirus, intrusion protection, improved intrusion detection. And they also facilitate behavioral monitoring to look for anomalies and known bad behavior. They also provide the ability to have a security tunnel to all of your endpoints and all of your assets in the multi cloud environment.”

Additionally, security defenses need to work at speeds that accommodate the increased volume of traffic, and the need to encrypt, decrypt and analyze that traffic as it flows across the environment.

Robert Wood, CISO at the Centers for Medicare and Medicaid Services says what these changes are really driving “is a change in the way that we go about detecting and responding to issues in our environment,” which means that agencies need to have the resources to interface with all their endpoints and store the data so they can shift into more of a data-centric and engineering-centric workforce. “I think that’s the way of the future for the security industry, and it’s where we need to go.”

Hear more for our government leaders, and other participants in this video series, including:

• Anthony O’Neill, CISO, Massachusetts
• Craig Hurter, deputy CISO, Arizona
• Gerald Caron, former CIO, HHS OIG
• Jane Zipoli, federal civilian cybersecurity leader, Cisco
• Ryan Murray, deputy CISO, Arizona
• Tony Plater, CISO, Dept. of the Navy

This video series was produced by Scoop News Group for FedScoop and sponsored by Cisco.

The post Defending a dynamic perimeter with modern firewall technologies appeared first on FedScoop.

The post Enhanced security resilience for government with modern firewalls appeared first on FedScoop.

However, varying degrees of deployment — and integration — of essential security tools continue to hamper agencies’ ability to strengthen their security resilience, say federal IT respondents in a recent FedScoop survey. And efforts to improve agencies’ security posture often compete with the growing demands of agency missions.

The new report, “Security Resilience in Federal Government,” underwritten by Cisco, dives into the findings from a survey of 165 prequalified government leaders, IT and security directors and managers, procurement staff and IT influencers. The survey explored the kinds of security incidents impacting federal agencies and the strategies IT leaders are taking to improve security resilience for their agencies.

Nearly half of the respondents reported that their agency experienced a major security incident within the last year. They shared the types of security incidents that have impacted their agency the most, including network or system outage (56%), network or data breach (44%) and accidental disclosure (27%).

While agencies have come a long way in recent years to build security resilience, there are several challenges that organizations continue to face to modernize IT risk management tools, beyond the demands of the mission, including:
• Creating a security culture embraced by all employees (33%)
• Adapting to unexpected external change events or trends (30%)
• Containing the spread or scope of security incidents (30%)

Respondents indicated their agencies are, however, coming along in adapting modern security capabilities. The report stated that federal agencies already have “in place” or “in progress” implementing a range of modern security capabilities and policies, including:
• Endpoint detection and response (67%)
• Network detection and response (84%)
• Extended detection and response (66%)
• Secure access service edge (SASE) (61%).

Respondents also reported how far their agencies were in deploying or planning micro-segmentation of application workloads, enterprise single sign-on, continuous validation of users and devices, risk-based vulnerability management, and other practices to improve security resilience.

As leaders continue to push towards an integrated security architecture, they will want capabilities that support the ability to learn and adapt to changing security needs.

“Agency leaders should consider tools that work together to manage the network, integrate threat intelligence and integrate with their other security products and solutions using open-industry standards,” said Norman St. Laurent, cybersecurity specialist at Cisco, in reaction to the findings.

“I often advise leaders to consider route/switch and WAN solutions alongside comprehensive security products, which may be strange, but as part of an overall security strategy, they offer three critical benefits,” he explained.

“First, they are a cost-effective means to gather data to assess threats against the network. Second, granular network segmentation allows IT teams to restrict attack and threat vectors on ports used for wired and wireless infrastructures. And finally, these solutions create more agile and scalable networks that can handle future growth.”

Download the full report “Security Resilience in Government” for detailed findings and guidance on strengthening security resilience.

This article was produced by Scoop News Group for FedScoop and sponsored by Cisco.

The post Too many products, not enough integration hampers agency security resilience appeared first on FedScoop.

The strategy should identify technology sectors where government wants to innovate, while allowing markets to determine when they’re ready for commercialization and leave standardization to the experts, said Alissa Cooper, chief technology officer at Cisco Systems, Inc., during a House Subcommittee on Research and Technology hearing Thursday.

Standards developed by the National Institute of Standards and Technology enable innovation, technology commercialization, resilient infrastructure and U.S. competitiveness. While the U.S. has had a high-level, quinquennial standards strategy for the last 20 years courtesy of the American National Standards Institute, the White House may consider crafting its own to rival the one the EU adopted in February.

“I think now is an important moment for the U.S. to assert its own strategy, in particular, because it could be valuable as a contrast to what the European Union has proposed,” Cooper said. “They’re really looking at taking much more of a government-directed approach that diminishes the role of industry.”

For standards developed by the National Institute of Standards and Technology to be relevant, the agency needs companies prepared to commercialize the corresponding technologies to bring them to market and use the standards to drive universal adoption, she added.

Companies jump on standards “when they can make money,” as was the case when four or five competing wireless standards ultimately gave way to Wi-Fi for long-distance communication and Bluetooth for near communication, said Andrew Updegrove, cofounder of the law firm Gesmer Updegrove L.L.P.

The EU isn’t the only competitor the U.S. should be worried about with China making “significant investments” to participate in standards setting organizations (SSOs), give the global reliance on standards, said James Olthoff, acting director of NIST.

While the Department of Commerce meant well when it added Huawei to its Entity List in 2020 — thereby restricting the Chinese-based telecom company’s access to U.S. technology produced domestically and abroad — given national security concerns, the decision had ripple effects in the standards world.

“Adding Huawei to the Entity List without a workable [standards development] exemption caused great disruption to hundreds of SSOs as they scrambled with frustration to understand what was required of them and then restructure,” Updegrove said.

In the end Huawei was free to participate in SSOs, while U.S. companies decided they would not due to compliance concerns. Some SSOs moved to Europe, when the U.S. needed to be respected and in the room, Updegrove said.

Rep. Haley Stevens, who chairs the subcommittee, expressed concern agencies tasked with advancing U.S. competitiveness like NIST lack the funding, authorities and infrastructure to do so.

The House recently passed Stevens’ NIST for the Future Act, which would increase the agency’s budget by 18% this year and double it over the next, if passed by the Senate and signed by the president.

“As it appears, NIST simply does not have the resources or the staff to be fully engaged in international standards-setting activities,” Stevens said.

The post First-ever federal standards strategy would make NIST’s work more relevant to industry appeared first on FedScoop.

CISA on Monday added the exploit to its catalog and identified it as a critical remote code execution (RCE) flaw. The DHS sub-agency has also launched a webpage hosting guidance for how agencies and private sector companies should respond to the vulnerability.

Under prior binding operational directives issued by the Department of Homeland Security, agencies have 15 days to respond to vulnerabilities once they have been designated as “critical risk,” and 30 days for “high risk” vulnerabilities.

CISA in April 2019 issued binding operational directive 19-02, which sets out the timeline that agencies have to take action once a flaw has been identified.

Log4Shell is a zero-day vulnerability that emerged last Thursday when it was exploited in remote code compromises against the servers of video game Minecraft, Ars Technica earlier reported.

The vulnerability affects much of the internet, and since its disclosure last Thursday cybersecurity firms have detected active scanning by actors seeking to identify vulnerable servers.

Log4Shell exploits the widely used, Java-based logging tool Log4j, which has the ability to perform network lookups and to execute any executable payload with full privileges of the main program.

“The scope of this vulnerability is such that there is no doubt there will be impact in federal agencies,” said Matt Olney, director of threat intelligence and interdiction at Cisco Talos.

He added: “This is a test for any organization, but particularly organizations at scale, as to how quickly they can identify and mitigate the risk in their networks, while fending off active attacks as well.”

CISA last month issued a separate binding operational directive that gave agencies 60 days to review and update vulnerability management procedures.

The post Federal agencies have until Dec. 24 to apply fixes for Log4Shell vulnerability appeared first on FedScoop.

Walter Maikish, VP, Federal Civilian Business, Cisco and Zain Ahmed, Regional VP, Federal Business, Lumen

The pandemic and almost overnight massive shift to telework forced federal agencies and IT leaders to make their digital services more accessible to their employees and constituents. They rallied, met their mission and discovered that the need to modernize their IT infrastructure and get the most from cloud-based solutions had become more important than ever before.

Fortunately, the General Services Administration’s Enterprise Infrastructure Solutions (EIS) contract gives agencies a once-in-a-generation opportunity to modernize as they see fit. EIS and the Alliant 2 Government Wide Acquisition Contract (GWAC) provide not only a path to migrate away from aging telecommunication systems to today’s technologies, but also paved the way for building a more modern, flexible and cost-effective IT and communications environment overall.

However, some agencies are still missing a critical opportunity to capitalize on EIS’s potential.

It’s probably not surprising that the demands of the pandemic delayed the work of agencies moving their IT services to EIS. But we didn’t expect to see so many requests for proposals (RFP) focused on replacing “like-for-like” IT infrastructure instead of seeking a more holistic review of their infrastructure centered on improved efficiency and effectiveness. As a result, many of these RFPs left little room to consult with industry providers on all the technology options that are available in the market, what these technologies can now do today and how they can lower overall costs.

What these RFPs also tend to miss is an even bigger opportunity to envision IT infrastructure from an outcomes-based perspective focused on big picture modernization strategies. At the end of the day, the goal is to bring greater agility, efficiency, security and long-term cost savings to agencies’ ability to meet their mission.

Focusing on outcomes rather than technology

We are seeing some great examples of agencies seeking to really modernize their IT infrastructure at agencies such as Veterans Affairs and the U.S. Geological Survey, for example.

When a large, cabinet-level agency decided to update their IT infrastructure, for instance, they prioritized objectives in their RFP that outlined outcomes for their mission, rather than prescribing specific hardware or technologies to acquire.

That holistic approach created an opening for Cisco and Lumen to bring our combined expertise to the table and reimagine the large, cabinet-level agency’s network in a way that brings significantly more value to how they work than would have been possible with a like-for-like update of the older telecommunications systems acquired under the previous Networx contract.

Using the outcomes-based approach, we were able to propose an SD-WAN roadmap that provides more robust automation, network orchestration and secure capabilities than most existing networks. These modern solutions can help ensure that applications perform faster and make digital interactions more secure, especially with data being stored at the edge of the network for quicker access in places such as national parks. And even though this large, cabinet-level agency operates in many remote locations, our solution provided substantial network upgrades to those locations and to their users and visitors who previously didn’t have access to reliable internet access.

The Department of Veterans Affairs, similarly, took a more forward-looking approach to modernizing its infrastructure and broadband capacity, and as a result, was able to dramatically scale up its use of tele-health services for the benefit of veterans as well as its medical teams.

The promise of outcomes-driven RFPs

As agency leaders consider the rapid evolution of technology, it’s easier than ever before to see additional benefits arising from an outcome-driven approach.

For example, when an industry partner promises to deliver on mission outcomes, rather than simply deliver a requested technology platform, the agency benefits from being able to transfer a certain amount of risk to their partner. That in turn incentivizes that partner to recommend technologies that are in the agency’s best interest long term.

It’s from that perspective that we recommend agency leaders consider re-evaluating how they frame their RFPs, starting with:

• Consider how infrastructure serves the mission: IT infrastructure is no longer a back-end function of service delivery. Rather, it is the backbone and serves as the nervous system for how agencies meet their mission goals. Leaders need to frame RFPs to focus on outcomes from a mission perspective and then work backwards in defining their IT needs. And leaders would be better served if they didn’t focus so much on their old assets or history.
• Think about the roadmap to get there: Rather than be prescriptive — which is how many RFPs tend to be written — agencies should think about specific mission outcomes to achieve and define what success looks like in serving their agency’s end users and bureaus.
• Choose a partner who is in it for the long run: An industry partner shouldn’t just continue to build and add more things. Rather choose one which is committed to your agency’s mission outcomes and that can advise your management team about new IT capabilities coming into the market that can improve mission results.

And finally, it is important to remember that RFPs are just one milestone in an ongoing IT modernization journey. So don’t stop there. Keep your foot on the accelerator in modernizing your IT infrastructure and look for ways to support continual improvements that serve the agency, serve the citizen and serve stakeholders.

Learn more about what your agency needs to get up to speed on EIS, Alliant 2 and other contract vehicles that enable IT modernization and how Lumen and Cisco can help you get there.

The post Using outcomes-based RFPs to modernize IT infrastructure faster appeared first on FedScoop.