AI Paving the Way for New Healthcare Innovations

Posted on by Tim Boltz

With the boom of consumer facing artificial intelligence (AI) through Chat GPT and other tools, the discussion of AI applications within healthcare has also become a priority with exciting new developments. Pre-COVID, there was some hesitancy with telehealth, whereas now it has become a highly valued, main offering within the healthcare ecosystem. Similarly, AI is becoming a key mobilizer for improved patient outcomes and more efficient provider processes. Through the power of the cloud and supercomputing, AI is opening doors for transformational results throughout all aspects of healthcare including personalized medicine, medical research and trials, treatment efficacy and more. Once healthcare organizations better understand the benefits that AI unlocks for all stakeholders, they can take the next steps to apply it to their individual health networks.

Benefits of AI in Healthcare

Patients

The potential uses for AI in the medical field are endless and apply to all levels of healthcare with improvements for patients, healthcare providers and healthcare administrators. When organizations invest in AI, it decreases wait times for patients, optimizes appointment availabilities and increases overall access. AI can also interpret imaging and detect illnesses faster which minimizes treatment delays. Through wearable technology and personalized medicine, AI is enabling patients to gather health data and manage treatment from home. This customizable capability is especially valuable for rural or low-income patients to level out the social determinants of health and offer treatment through telehealth while saving on costs for all involved.

Medical Providers

AI can significantly reduce the administrative burden for medical providers by automating routine tasks and increasing bandwidth for front line staff to complete other medical duties. A hallmark capability for AI is analyzing data which it can aggregate from wide pools of information to suggest electronic health record (EHR)-based interventions, predict possible future patient ailments and offer a more unified, comprehensive picture. In a post-COVID-19 world, AI healthcare data applications offer the extremely relevant and desired ability of anticipating future public health crises through research and analytics. These AI forecasts can accelerate understanding for policy creation, reinforce healthcare resources and provide precision public health.

Healthcare Administrators

Applying for grants can be a time-consuming process, but with AI evaluating grant proposals, healthcare administrators can quickly identify which grants to apply for and which to pass. AI can also detect potential fraud cases. It is currently being implemented at the Centers for Medicare and Medicaid Services to make sure that applicable citizens receive the proper care and services they deserve, and by the Department of Health and Human Services to analyze counterfeit drugs to prevent fraud and preserve the efficacy of vital medications.^[1]

Making AI a Reality for Individual Healthcare Networks

With these groundbreaking benefits, instituting AI is a clear case. Currently about 98% of healthcare organizations have or are planning to implement an AI strategy.^[2] To make this a reality, healthcare organizations must focus on three main areas:

Understanding the technology capabilities, requirements and use applications
Educating providers and building trust with patients
Instituting privacy and security policies

Understanding what AI can do, which applications to pursue for individual hospitals’ use cases and what it takes to operate the technology, needs to be a collaborative effort between all levels of a hospital system. Many clinicians are burned out and looking for tools that will ease their burden while also improving care. Through proactive conversations with medical providers and C-suite stakeholders, CIOs and management can present the investment benefits and ultimately increase full system buy-in and ability to scale effectively and efficiently.

Educating medical ecosystems and patients with the digital skills and knowledge to utilize the technology resources is also important for proper usage and increased adoption. Once providers understand the potential of AI and the practical ways it can improve their workflows, they can be confident in using the tools and clearly articulating the information to patients. Trust is a huge component of thriving, effective care. Clearly presented information establishes that rapport with patients and clinicians. Overall, training re-establishes for providers and administrators the priorities of patient safety, professional accountability and protection from reputational, legal and financial risk to ensure that the AI technology is used responsibly. Through proper education, patients also feel empowered with how AI is being implemented in their care and the commitment of their medical team to pursue the safest and best outcomes.

The last key element to establishing the use of AI in healthcare and maximizing its benefits is keeping privacy and security top of mind. Hospital management need to consider what policies and procedures they will institute to protect patients’ data and prevent bad actors from exposing personal information or disrupting care. Data integrity is also vital to keep AI algorithms’ predictions and assessments accurate. Healthcare network administrators will need to evaluate the best method to securely store that data whether through a cloud provider or building encrypted data storage on premises using private AI with an internal high computing platform specific to the individual hospital. These management policies and governance frameworks will not only offer standardization, they will also help build trust with patients while providing enough flexibility for AI innovation and growth.

Ultimately the partnership of AI with medical experts enables the perfect balance to deliver rapid, actionable insights and improvements while humans manage the usage of the technology to ensure quality care for each medical case. The future of healthcare is patients being able to take greater ownership of their health through aggregating additional data and applying AI to achieve better treatments. Providers and staff will be able to maximize their time through AI optimizations and provide more proactive care based on AI predictions. These advancements will revolutionize the healthcare industry as we know it and pave the way for a healthier society. Some are calling AI the next quantum leap in technology, and healthcare should be at the forefront of leveraging the resources to drive improvement, accelerate innovation and save lives.

To learn more about how Carahsoft is enabling healthcare organizations to achieve technology innovations such as AI, visit our Healthcare Technology and AI and Machine Learning solutions portfolios and speak to a representative who can help meet your solution needs today.

Resources:

[1] “HHS CIO Karl Mathias Details 3 Promising Applications of AI in Health Care Sector,” GovConWire, https://www.govconwire.com/2023/05/hhs-cio-karl-mathias-details-3-promising-applications-of-ai-in-healthcare/

[2] “AI Survey: Health Care Organizations Continue to Adopt Artificial Intelligence to Help Achieve Better, More Equitable and Affordable Patient Outcomes,” Optum, https://www.optum.com/about-us/news/page.hub.ai-survey-health-care-organizations-adopt-artificial-intelligence.html

Adobe Express: The Content Creation Powerhouse

Posted on by Gary Reburn

Adobe Max 2023 has finally arrived, and with it came a slew of intuitive new features and software options. As expected, Adobe’s primary focus this year was on its powerful AI innovations and tools. Unexpectedly however, Adobe Express, an application which previously was focused on social media content creation has received an enormous upgrade. So, let’s talk about these exciting new features and why it’s exciting for the government space.

Adobe Express is a powerful software suite that has gained significant traction in various industries for its user-friendly interface and versatile tools. While it’s widely known for its applications in creative fields such as graphic design, marketing, and content creation, its potential in the government space remains largely untapped and yet to be fully realized. Its adaptability and diverse functionalities make it an asset for government agencies seeking efficient solutions for their content related projects.

One of the primary advantages of Adobe Express in the government sector is its ability to streamline communication. The software allows for the creation of visually engaging documents, presentations, and reports, enabling agencies to convey complex information in a more digestible and visually appealing manner. Whether it’s producing internal reports or communicating with the public, the software’s intuitive design tools aid in crafting impactful visual content, enhancing the effectiveness of government messages.

Adobe Express Content Creation Blog Embedded Image 2023

Furthermore, Adobe Express’s compatibility with various file formats ensures seamless integration with existing government systems. This feature is pivotal in maintaining consistency and compatibility across different departments and agencies, facilitating the exchange of information and collaboration between various governmental bodies. It promotes a standardized approach to document creation, reducing compatibility issues and simplifying the sharing of information.

Data security and compliance are of utmost importance in the government sector, and Adobe Express offers robust security features to ensure the protection of sensitive information. With encryption, user authentication, and secure cloud storage options, the software provides a level of security essential for government use.

Another aspect worth highlighting is the software’s ability to handle a wide variety of tasks within government operations. From creating visually rich training materials for employees to designing public awareness campaigns, Adobe Express caters to a wide range of needs. Its features enable the development of interactive forms, streamlined workflows, and the creation of accessible content, ensuring inclusivity within government initiatives.

In addition, the software’s capacity for analytics and data visualization aids in the communication and presentation of complex information. This capability is invaluable in governmental decision-making processes, enabling officials to comprehend data more effectively and communicate insights to stakeholders and the public.

The use of Adobe Express can also lead to cost and time efficiencies within government departments. The software’s user-friendly interface reduces the need for extensive training, allowing employees to quickly grasp its functionalities. Its cloud-based solutions minimize the need for extensive physical infrastructure, reducing costs related to storage and maintenance.

As the digital landscape continues to evolve, the implementation of Adobe Express in government operations becomes increasingly relevant. However, its adoption may require tailored training programs and guidelines to ensure its optimal use and adherence to government protocols and standards.

In conclusion, Adobe Express offers a variety of tools and features that can significantly benefit government agencies. From enhancing communication and data security to fostering efficiency and innovation, its application in the government space holds immense potential, paving the way for more effective and visually compelling government initiatives.

Contact our team today to learn more about the latest trends discussed at Adobe MAX 2023 and how Carahsoft’s Adobe experts can support your organization.

Empowering Education: Nutanix and the E-Rate Program

Posted on by Chris Seguin

The U.S. Telecommunications Act of 1996 established the E-rate program to ensure affordable access to telecommunications and internet services, particularly for schools and libraries in low-income and rural areas. E-Rate consists of two categories:

Category One: This covers data transmission and internet access services, including broadband connectivity and data links connecting multiple points.
Category Two: This category focuses on eligible equipment, such as wireless access points, controller systems, routers, switches, and essential software-defined networking (SDN) and firewalls. Nutanix is a recognized provider of Category Two services under E-Rate, enhancing digital learning, IT security, and affordability.

During 2023, the third year of the 5 year E-Rate budget cycle, Nutanix and Carahsoft worked with a handful of customers across the country, and successfully funded and implemented multiple projects through USAC and the E-Rate program.

As we enter the fourth year of the 5 year E-Rate budget cycle, schools and libraries have 2 years left to utilize the E-Rate funds available to them. Schools and Libraries have an opportunity to fast track their digital modernization efforts with E-Rate funding. Let’s delve into the Nutanix E-Rate Solution.

Nutanix on E-Rate Education Blog Embedded Image 2023

Nutanix’s Integrated Solution: Nutanix offers an integrated software-defined solution based on hyperconverged infrastructure. This solution streamlines networking, physical security, diagnostics, and firewalling, eliminating the need for separate legacy systems. It can be consolidated onto the Nutanix Cloud Infrastructure (NCI), reducing physical device footprint, costs, and management workload. It also integrates seamlessly with Nutanix and third-party products to create a robust infrastructure stack.

Unified Management: Nutanix provides a single pane management interface for all physical and virtual resources. This simplifies the management of diverse IT environments, allowing educational IT leaders to oversee data services, workload security, uptime, SLAs, virtual networking, and governance from a centralized dashboard.

Security and Compliance: Nutanix’s software incorporates robust security measures, automating compliance and providing self-healing capabilities. NCI centralizes network and security services, ensuring efficient functionality and effective incident response. It offers advanced network security, application-centric protection, and monitoring for security and compliance.

Software-Defined LAN: Nutanix’s software-defined LAN technology extends Layer 2 networks across sites using virtual extensible LAN (VXLAN) technology. This enables the delivery of broadband IPv4 services without additional hardware, improving uptime and adaptability.

Accelerate IT Modernization: Nutanix accelerates IT modernization at any stage, and E-Rate qualification allows schools and libraries to save up to 68% on eligible solutions through Category Two funding.

For more information, visit www.nutanix.com/E-Rate or contact Nutanix at NutanixSLED@Carahsoft.com or E-Rate@Nutanix.com to explore how their solutions can meet your specific needs.

View our webinar and dive deeper into how Nutanix can support your institutions education journey through the E-Rate program.

*Information in this blog was updated on November 7, 2023 to reflect more up-to-date, accurate information.

DevSecOps: Achieving Efficiency and Scale with Automation and Software Factories

Posted on by Rich Savage

In today’s rapidly evolving digital landscape, Government agencies face many challenges in delivering modern, secure software applications to the end-user. DevSecOps is a methodology that combines development, security and operations to create a more streamlined and secure software development process. This concept has emerged as a transformative approach that integrates security practices, automation and software factories into the software development lifecycles from its inception. At the Carahsoft DevSecOps Conference, industry experts and innovators shared their knowledge of emerging tools, effective strategies and methodologies in software engineering through several educational sessions.

Unlocking Efficiency: The Power of Automation and AI/ML

Automation helps developers improve the efficiency and quality of code, reduce risk and combat security vulnerabilities. As a key component of DevSecOps, automation allows developers to simplify many of the tasks involved in software development, such as testing, deployment and monitoring. Once automated, developers can focus on writing high-quality code and addressing security vulnerabilities, rather than spending time on redundant manual tasks.

The use of AI has transformed the way developers work, compared to 20 years ago when code was primarily written from scratch. Today, external libraries — software code written by a third-party source — are used frequently which introduces a new set of risks and benefits. The benefits include making software development faster and more efficient as developers use pre-existing code to build their applications. However, if a third-party library has a security vulnerability, it can be exploited by malicious actors to gain access to sensitive data. If not maintained properly, the third-party library can become outdated and incompatible with other software components.

Software Factories

Software development has become an essential part of today’s business operations, and Government agencies are constantly seeking ways to improve their processes. Recently, the concept of the software factory—a structured approach to software development that emphasizes standardization, automation and collaboration—has gained popularity. It establishes a set of tools, processes and best practices that enable teams to develop software more efficiently and effectively. The goal of a software factory is to create a repeatable and scalable process for software development that can be applied across different projects and teams. By implementing this strategy, agencies can improve the quality, speed and consistency of their software development efforts.

One of those best practices, Continuous Integration and Continuous Deployment, are combined in a single process known as CI/CD. CI is the practice of frequently merging code changes from multiple developers into a shared repository, where automated tests are run to address integration issues early in the development cycle. This ensures the code is always in a releasable state and reduces the risk of conflicts and errors when changes are merged. CD, on the other hand, is the practice of automatically deploying code changes to production as soon as they pass the necessary tests and checks. Thus, enabling teams to release software changes quickly and frequently. By utilizing CI/CD, teams can achieve a continuous flow of code changes from development to production, which is imperative for modern software development.

Elevating DevSecOps: A Blueprint for Integrating Early Software Security Measures

Securing software in a containerized environment presents unique challenges due to the dynamic nature of containers and the distributed nature of container orchestration platforms like Kubernetes. Government agencies must ensure that containers are properly configured and secured, as misconfigurations can lead to vulnerabilities that can be exploited by attackers. Another difficulty is detecting and responding to security incidents in a timely manner, as containers can be spun up and down quickly and may be spread across multiple nodes in a cluster. Securing software early can help agencies reduce risk, lower costs, deliver software faster and improve collaboration between development and security teams.

Another crucial component of DevSecOps—continuous delivery—enables teams to deliver software changes quickly, safely and sustainably. This means that teams can release software changes frequently and with confidence, knowing that the changes have been thoroughly tested and are ready for production. Through a combination of automation, collaboration and feedback loops, continuous delivery helps reduce the time and effort required to release software changes.

Agencies can adopt a DevSecOps approach that integrates security into the software development lifecycle from the beginning. This involves using tools and processes to automate security testing and validation, as well as incorporating security requirements into the development process. For instance, agencies can use tools like vulnerability scanners and security-focused container images to detect and remediate vulnerabilities in containers. They can also use automation to validate security requirements and ensure that containers are properly configured and secured.

Securing software early in the development process can lead to several benefits including:

Reduced risk of security incidents: By identifying and addressing security vulnerabilities early in the development process, agencies can minimize the risk of security incidents and data breaches.
Lower costs: Fixing security issues later in the development process is much more expensive than addressing them early on. By integrating security into the development process from the beginning, agencies can reduce the cost of fixing security issues and avoid costly rework.
Faster time to market: Adopting DevSecOps approach can help agencies to deliver software faster by automating security testing and validation. This decreases the time for manual testing and enables faster release cycles.
Improved collaboration: Agencies can strengthen collaboration between development and security teams to ensure requirements are properly understood and incorporated into the development process. This proactive initiative can help foster a culture of security throughout the agency.

The adoption of DevSecOps, along with its fundamental principles, empowers Government agencies to establish a more efficient and secure software development process. This is achieved through the implementation of automation, the adoption of a software factory approach and the early integration of security measures.

To learn more about DevSecOps best practices and trending innovations, visit Carahsoft’s DevSecOps vertical solutions portfolio.

*The information contained in this blog has been written based off the thought-leadership discussions presented by speakers at Carahsoft’s annual DevSecOps Conference.*

Transforming State and Local Government in Ohio Through Technology

Posted on by Robert Moore

Innovation and collaboration are imperative to drive growth and transformation in State and Local Governments, as well as the need to invest in education and training to prepare the workforce for the jobs of the future. At the Carahsoft Digital Transformation Roadshow in Columbus, Ohio, Government IT and industry leaders engaged in dynamic discussions around the role of technology in shaping the modernization of the state of Ohio and beyond.

Technology Innovation in State and Local Government

Ohio State and Local agencies have begun to integrate innovative technologies to drive better decision-making while lowering the cost of ownership for IT systems; however, this requires significant investment in infrastructure, training and talent acquisition. Agencies must also ensure cybersecurity and risk management, as the use of new technology can create new vulnerabilities. There is a critical need for education, collaboration and innovation as State and Local agencies reimagine the future workforce which is an ever evolving complex and diverse ecosystem.

When faced with implementing technologies like artificial intelligence (AI), internet of things (IoT) and other transformational technologies, comprehensive planning is the best way forward for State and Local agencies. By doing the planning upfront, agencies can ensure that they have the right tools to manage vulnerabilities, mitigate risks and drive innovation.

Utilizing a single platform that connects automation of other tools into that platform helps agencies get real-time data reporting and addresses risk within the organization. By using multiple endpoint management and security tools in a single platform, agencies can streamline their operations, reduce costs and improve their overall security posture.

A local agency in Westerville, Ohio has started using data for applied analytics and customizing citizen experiences using a feedback model. This approach involves analyzing and interpreting data to improve services and provide a more streamlined citizen experience for services like trash collection, public safety and traffic management. By using data to drive decision-making and improve services, agencies can become more efficient, effective and responsive to the needs of citizens.

Building a Resilient Government

Modernizing systems, which is the top priority for building a resilient Government, will improve citizen services, generate cost savings, increase security and provide a more holistic, human-centered Government experience. Many State and Local agencies have outdated systems and need to modernize their infrastructure and business processes to make commerce more accessible and efficient. This involves evaluating areas for improvement, such as replacing fax machines with modernized digital tools and platforms and consolidating multiple systems into a few with all the key functionality they need.

The Ohio Department of Aging (DoA) implemented a tenant of rapid response in which automated systems provide emergency staffing within 24 hours for long-term care facilities and nursing homes during the COVID-19 pandemic and continue to this day. The DoA has also worked on predictive modeling utilizing the Governance, Risk and Compliance (GRC) organizational strategy to identify potential issues and respond proactively. Additionally, it has focused on meeting citizens’ needs through an omnichannel approach, using interoperable data analytics and predictive modeling to provide a more personalized and efficient experience.

Combating Cyber Threats in Government

Public Sector organizations face a range of cybersecurity risks, including data exploitation, insider threats, third party vulnerabilities, ransomware, identity theft and fraudulent access to State Government services. To mitigate these risks, agencies can take steps such as implementing strong access controls, regularly updating software and systems, conducting employee training on cybersecurity best practices and partnering with other organizations to share threat intelligence and collaborate on incident response.

Cybersecurity and Infrastructure Security Agency (CISA) offers several services to assist Government agencies with cybersecurity, including assessments and external dependency mapping. These services are provided at no cost to agencies, as they are already paid for by federal taxpayers. The services include:

Cybersecurity assessments: conduct cybersecurity assessments, which can help identify vulnerabilities and areas for improvement.
Ransomware readiness assessments: prepare for and respond to ransomware attacks, which are a growing threat to State and Local Governments.
External dependency mapping: identify and assess third-party vendors and other external dependencies, which can be a source of cybersecurity risk.
Threat intelligence sharing: provide agencies with information on emerging threats and best practices for defending against cyber-attacks.
Incident response planning: develop and test incident response plans, which can help ensure a coordinated and effective response in the event of a cyber-attack.

As cybersecurity threats become more sophisticated, it is increasingly critical for individual employees to be aware of the risks and take steps to protect their agency. Following best practices for password management, avoiding suspicious emails and links and reporting any potential security incidents to IT or security personnel is imperative. Agencies should provide regular training and offer resources such as phishing simulations to help employees become more vigilant.

Agencies must continue to leverage technology, utilize resources like CISA, stay up to date on the latest best practices and remain committed to meeting citizens’ needs. By embracing technology innovation, State and Local agencies can create a brighter future for all.

Explore more resources and learn more about Carahsoft’s State and Local Roadshow Series: Digital Transformation by visiting our Roadshow portfolio.

*The information contained in this blog has been written based off the thought-leadership discussions presented by speakers at Carahsoft’s Digital Transformation Roadshow.*

Critical Infrastructure in Cybersecurity: Innovation for the Transportation Sector

Posted on by Alex Whitworth

In 2021, the presidential administration passed the National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems, aiming to bolster the cybersecurity posture of critical infrastructure in the United States. Various agencies, such as the Transportation Security Administration (TSA), Department of Transportation (DOT) and the Cybersecurity Infrastructure Security Agency (CISA), have been working to continuously improve the security of the transportation sector, which oversees the movement of people and goods across the country.

The Transportation Sector

Within the transportation sector, initiatives have been taken to help fund cybersecurity improvements in an array of subsectors. The transportation sector includes:

Aviation: Approximately 450 commercial airports, 19,000 airfields, air traffic control systems, heliports, landing strips, joint-use military airports, sea plane bases, manned and unmanned recreational aircraft and flight schools^[1]
Highway and motor carriers: Managing roadways, bridges, tunnels and commercial vehicles such as motorcoaches and school buses traffic management systems
The maritime transportation system: Approximately 95,000 miles of coastline, 361 ports and over 10,000 miles of navigable waterways
Mass transit and passenger rail: Terminals, operational systems, transit buses, monorails, trolleys and rideshares
Pipeline systems: Carriers of natural gas, hazardous liquids and various chemicals
Freight rail: Major carriers, smaller, active railroads, freight cars and locomotives
Postal and shipping: Regional and local couriers, mail management firms, charters and delivery services^[2]

Security Directives

Due to persistent threats to the cybersecurity of critical infrastructure, including the transportation sector, the TSA issued multiple security directives for various transportation types, including railways and pipelines. These new directives require agencies to develop approved implementation plans that will help improve cybersecurity resilience, proactively assess the effectiveness of cybersecurity measures and prevent the deterioration of infrastructure.

The directive also requires that entities regulated by the TSA proactively work to implement amendments in the directive, including to:

Develop network segmentation policies so that Operational Technology (OT) can continue working, even when compromised
Prevent unauthorized access to critical infrastructure systems by enabling control access measures
Identify vulnerabilities and implement security patches for operating systems, applications, drivers and firmware to reduce the risk of exploitation
Detect malicious software and unauthorized access on Information Technology (IT) or OT systems and report designated incidents to CISA
Isolate infected systems from uninfected systems to limit the spread of malware, deny further access and to preserve evidence of compromise^[3]

A similar initiative, introduced by the DOT in 2022, aims to improve security awareness amongst employees. All DOT network users are required to complete the DOT’s Security Awareness Training, which is inspired by various federal requirements and the DOT Order on Department Cybersecurity Policy. The training measures employees’ knowledge in cybersecurity, including password and PIN protection and basic security for information systems.^[4]

By striving to improve the security posture of the transportation sector, the TSA, DOT and CISA endeavor to protect the safety of the nation.

Cybersecurity Funding for the Future

The DOT has also introduced measures to improve the national security posture. To leverage funding from bipartisan infrastructure, the U.S. Transportation Secretary Pete Buttigieg announced up to $45 million in grants for various University Transportation Centers (UTC). These grants will be utilized to improve the cybersecurity resilience of agencies affiliated with roads, bridges, rail, shipping and airspace. One of these grants will go to Clemson University to lead a consortium focused on cybersecurity research and development. Another of these grants will go to Prairie View A&M University to improve technology in the transportation system, including data related to artificial intelligence and environmental resilience.^[5]

Ever since the Colonial Pipeline attack of 2021, as well as other attacks on the cybersecurity of critical infrastructure of the United States, various agencies have done their part to improve the nation’s security. Through CISA’s hard work to create cybersecurity guidelines and cross-sector performance goals and the Federal Government’s generous grants, the nation’s critical infrastructure is postured to increase security and resolve potential crises.

This blog is the final installment in our four-part series, which examines cybersecurity initiatives inspired by The White House’s National Security Memorandum. The first three parts covered the basics of critical infrastructure cybersecurity, an overview of the Water and Wastewater Sector, and an overview of the Electric and Utility Sector.

To learn more about how agencies can bolster their cybersecurity efforts within critical infrastructure, visit Carahsoft’s Cybersecurity Solutions Portfolio.

Resources:

[1] “National Infrastructure Protection Plan,” Transportation Systems Sector, https://www.dhs.gov/xlibrary/assets/nipp_transport.pdf

[2] “Transportation Systems Sector,” Cybersecurity and Infrastructure Security Agency, https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector

[3] “Security Directives and Emergency Amendments,” Transportation Security Administration, https://www.tsa.gov/sd-and-ea

[4] “FY 2022 Department of Transportation Security Awareness Training,” Federal Motor Carrier Safety Administration, https://www.fmcsa.dot.gov/safety/fy-2022-department-transportation-security-awareness-training

[5] “U.S. Department of Transportation Funds Innovative Research Providing Vital Training for Next Generation of Transportation Leaders,” U.S. Department of Transportation, https://www.transportation.gov/briefing-room/us-department-transportation-funds-innovative-research-providing-vital-training-next

Transitioning Towards a Sustainable Healthcare Mindset at DHITS 2023

Posted on by Mike McCalip

Since the Defense Health Agency (DHA) oversees the entire military health system, it knows how important it is for members of the military and their doctors to be able to access medical records quickly and universally. In August 2023, the DHA hosted the Defense Health Information Technology Symposium (DHITS) where military health system (MHS) stakeholders discussed its newest asset– the Military Health System (MHS) Genesis. With the creation of this universal health record database, military members’ health records can easily be accessed, whether they are active-duty or not. Currently being rolled out in waves, the MHS Genesis plans to expand health records accessibility between different military branches.

Benefits from MHS Genesis

While still new, the MHS Genesis already shows improvements in several areas which include:

Enterprise and Cultural Interoperability: Some doctors may have different views or standards than others. This universal system makes patient files easily accessible to any doctor, regardless of military branch or practice. Now, the IT systems and Electronic Health Records (EHR) work together seamlessly. Different military branches will be able to use the same uniform system when it comes to accessing patient files and records, making the job easier for both patients and doctors.
Patient-Centric Care: With the MHS Genesis technology enhancements, it is now easier than ever to meet patients at their home on a Tuesday through telehealth. Telehealth is especially important within the military to give patients flexibility in choosing appointments as well as requesting information or gaining access to their medical records.
System and Process Automation: Medical professionals struggle with the global constraint of time. The MHS enables providers to automate tasks, saving time on things like paperwork and allowing for more one-on-one patient care.

Next Steps for the MHS

Currently, the entire DoD is at an 86% implementation rate for the MHS Genesis. It is actively being used in all DHA locations in the U.S. with plans to incorporate the universal health record system into the remaining treatment facilities outside of the United States by the end of 2023.

As leaders within the MHS continue their journey into modernization and sustainability, it is important that they equip people with the right knowledge and skills to be able to deliver their future vision of what military medicine should look like. The number one purpose of this emerging technology is to ensure the medical readiness of the military. The MHS Genesis will help guarantee that this stays a top priority, as it creates better access to information and helps deliver that information to the decision makers. Using Artificial Intelligence (AI) in medical settings is an exciting development that will help with diagnosing, personal assistants, risk analysis, forecasting and more. Through AI support, doctors will be able to spend more time on their patients and less time on large amounts of paperwork.

While the implementation of the MHS Genesis has been a success, all branches of the DoD must continue to communicate and collaborate openly and effectively. They must also involve other stakeholders by breaking down data silos and sharing freely what does and does not work in an enterprise setting. This will ultimately help with addressing public health challenges, ethically using AI in a medical setting, cybersecurity and more.

The MHS journey coincides with changing the deployment approach to a “sustainment” mentality. A sustainment mindset involves focusing on:

Optimization of user experience: Seeking feedback and continuing to adjust the technology to enhance user experience
Scalability: Scaling the success and implementing the changes across the enterprise if success is found with one configuration setup
Standardization: Creating a standard vocabulary and process for enterprise usage, so people communicate with the same terminology across the MHS

At the end of the day, the most important thing is that patients receive the care they need. Through the MHS Genesis and the IT solutions discussed at DHITS, the MHS hopes to greatly boost patient experiences, increase trust in the military health system, reduce healthcare provider burnout and give patients and clinicians access to data in real-time.

Visit Carahsoft’s Department of Defense and Healthcare solutions portfolios to learn more about DHITS 2023 and how Carahsoft can support your organization in these critical marketplaces.

*The information contained in this blog has been written based off the thought-leadership discussions presented by speakers at DHITS 2023.*

Generative AI, DevSecOps and Cybersecurity Highlighted for the Air Force and Space Force at DAFITC 2023

Posted on by Mike McCalip

Thousands of Space Force and Air Force personnel and industry experts convened to discuss the most current and significant threats confronting global networks and national defense at the 2023 Department of the Air Force Information Technology and Cyberpower Education & Training (DAFITC) Event. Throughout the many educational sessions, thought leaders presented a myriad of topics such as artificial intelligence (AI), DevSecOps solutions and cybersecurity strategies to collaborate on the advancement of public safety.

Leveraging Generative AI in the DoD

At the event, experts outlined three distinct use cases for simplified generative artificial intelligence in military training.

Text to Text: This type of generative AI takes inputted text and outputs written content in a different format. Text to Text is associated with tasks such as content creation, summarization, evaluation, prediction and coding.
Text to Audio: Text to Audio AI can enhance accessibility and inclusion by creating audio content from written materials to support elearning and education and facilitate language translation.
Text to Video: Text to Video AI is primarily geared towards generating video content from a script to aid the military with language learning and training initiatives.

Dr. Lynne Graves, representative of the Department of the Air Force Chief Data and Artificial Intelligence Office (CDAO), provided attendees with a brief timeline of how the USAF will fully adopt artificial intelligence. The overarching aim for AI integration is to make it an integral part of everyday training, exercises and operations within the Department of Defense (DoD).

In FY23, the DoD is focusing on pipeline assessment. Using red teaming where ethical hackers run simulations to identify weaknesses in the system, internal military personnel target improvement of their infrastructure and mitigation of the vulnerabilities in the different stages of the pipeline.
In FY24, the emphasis will be on the Red Force Migration policy, which involves developing, funding and scaling the necessary strategies.
In FY25, the goal is for the department to become AI-ready. This entails preparing for AI adoption at all agency levels, establishing a standard model card that explains context for the model’s intended use and other important information, creating a comprehensive repository of data and implementing tools for extensive testing, evaluation and verification.

USSF Supra Coders Utilize DevSecOps for Innovation

The current operations of United States Space Force (USSF) Supra Coders involve a range of activities that combine modeling, simulation and expertise in replicating threats. These operations are conducted globally, and currently include orbit-related activities, replication of DA ASAT (Direct Ascent Anti-Satellite) capabilities and the reproduction of adversarial Space Domain Awareness (SDA).

The USSF Supra Coders have encountered limitations with software solutions, including restrictions tied to standalone systems, licensing structures with associated costs and limited adaptability to meet the specific needs of aggressors and USSF requirements. DevSecOps presents a multifaceted strategy for mitigating the identified capability gaps noted by the USSF Supra Coders. It can help create more effective and efficient software solutions through seamless integration of security protocols, streamlining system integration processes, optimizing costs and enhancing customizability.

Cybersecurity Within the Space Force

Cybersecurity is a shared responsibility across the DoD but is especially relevant for the U.S. Space Force. As a relatively newly emerging branch of the military, the Space Force is still developing its cyber strategies. Due to its completely virtual link to its capabilities, the USSF must prioritize secure practices from the outset and make informed decisions to protect its networks and data.

Currently, the Space Force is engaged in the initial phases of pre-mission analysis for its cyber component which serves as a critical element for establishing and maintaining infrastructure through the integration of command and control (C2). These cyber capabilities encounter a series of complex challenges, which necessitate a multifaceted approach including the following solutions:

Enforcing Consistent Cybersecurity Compliance
Developing Secure Methods to Safely Retire Old Technology
Enhancing Cryptography Visibility
Understanding Security Certificate Complexity
Identifying Vulnerabilities and Mitigating Unknown Cyber Risks

While the Space Force faces a uniquely heightened imperative to bolster its cybersecurity capabilities with its inherent reliance on information technology and networks in the space domain, the entire community must collaborate effectively to achieve military leaders’ targeted cybersecurity capabilities by the goal in 2027.

The integration of generative AI in military training, innovations through DevSecOps by the USSF Supra Coders and cybersecurity initiatives of the Space Force collectively highlight the evolving landscape of advanced technologies within the Department of Defense. Technology providers can come alongside the military to support these efforts with new solutions that enhance the DoD’s capabilities and security.

Visit Carahsoft’s Department of Defense market and DevSecOps vertical solutions portfolios to learn more about DAFITC 2023 and how Carahsoft can support your organization in these critical areas.

*The information contained in this blog has been written based off the thought-leadership discussions presented by speakers at DAFITC 2023.*

Make Invisible Talent Visible

Posted on by Kelley Steven-Waiss

With strengthening and empowering the Federal workforce as a key tenant of the President’s Management Agenda, the critical need for people with cybersecurity skills and an aging workforce, now is the time for government to re-evaluate how it looks at the skills of employees. Moving to a data-driven talent strategy allows agencies to match the right people to the right work at the right time which also enhances that employee’s experience and engagement with their work.

Progression not Promotion

The first step is realizing that skills are not a title. For too long, career success has meant moving up GS levels or in title. A change in title does not necessarily mean being exposed to new experiences, gaining new skills or even gaining responsibility. The growth that comes with new challenges is what keeps employees fulfilled. That can happen when employees move into positions across an organization. Sideways needs to be the new up – not just for the growth of employees but for the mission achievement of government.

Keep Talent in Government

People enter public service because they have a tie to the mission. They want to work for that organization with a line of sight toward that mission. They do not leave because they stopped believing in the mission, they leave because they have not been given an opportunity to grow and develop. Research shows that one third of millennials and Gen Z workers leave a job because they did not see an opportunity to grow their career.

Talent sharing across agencies is a concept whose time has come. Government employees need to see career path options outside of their current organization. Where can their skills make an impact in another office or agency? Seeing a growth path will keep the talent within the government ecosystem rather than losing them to good commercial companies.

Diversify the Workforce You Already Have

A data-driven approach can go a long way in driving out bias and growing equity. Across government there are many opportunities for people to get involved in steering committees, pop-up projects and short-term initiatives. However, getting involved requires employees to be informed. We assume that people will seek out these opportunities. Employees only network with people they know – this limits what they are exposed to. Employees miss opportunities every day that are tailor made for their skills and career goals.

A data-driven approach automates the ability to engage. Opportunities can be pushed to employees that meet specific skills and capability criteria. Those employees can then engage with the opportunity through a digital workflow allowing them to quickly and easily break into a new network within the organization. No longer are we dependent on who we know. Now technology becomes a proactive, enabling force in finding the best fit based on skills, not position or education.

Personalize the Journey

Studies show that 94% of employees will stay with an organization longer if they feel it is invested in them. Providing a dynamic career path backed by training and mentoring opportunities is a way to demonstrate commitment to an employee.

A one size fits all training program ends up fitting no one. Employees have come to expect a personalized experience from all of the brands they interact with – whether that is music or movie recommendations or reminders to order more toilet paper. Data-driven organizations can offer that same experience by feeding employees programs and trainings that people actually want to participate in and learn from.

For organizations, knowing the growth areas for employees allows for more targeted efforts in offering reskilling and upskilling opportunities to the people who will most quickly benefit from the training.

ServiceNow is proud to support organizations ready to make the leap to a data-driven skills-based model. Our recent webinar showed how to move away from spreadsheets and emails and begin managing skills in an automated way that works for everyone – HR, agency leaders, supervisors and employees. View the full session here to learn how to transform how you hire, reward and grow your team.

3 Strategies the State Department Can Adopt to Successfully Balance Infrastructure Modernization and Security

Posted on by Chip Daniels

The Department of State’s (DOS) plan to modernize American diplomacy has two focuses: adopting critical and emerging technologies and strengthening cybersecurity. Secretary Antony Blinken cites these initiatives as an “aspect of foreign policy that has become critical in recent years.”

Yet, a recent survey indicates IT complexity is a top challenge when it comes to protecting against cybersecurity threats. The more technology added to a network, the harder it is to defend.

That’s why the DOS must adopt a security-first approach when building and deploying new IT infrastructure. By shifting security left, the organization will be better positioned to successfully balance modernization with security.

Here are three ways the DOS and other government agencies can achieve this objective.

Adopt a “secure by design” approach

Infrastructure modernization isn’t just about the tools that are added to a network. It’s also about the people who must manage the tools, and the different processes teams might use to ensure that everything works as it should. All of this creates additional complexity and increases how an attacker could infiltrate a network.

That’s why it’s critical to weave cybersecurity throughout every phase of infrastructure deployment. Every time a new system or application is installed, its introduction and implementation should be carefully vetted by a dedicated security team. All endpoints should be carefully monitored and inspected to ensure their fortification and all systems tested by red teams to verify their security postures and resiliency.

Simultaneously, all IT professionals should follow predetermined security guidelines throughout the software implementation process. These guidelines should be easily accessible and understood by everyone involved in the process. Simple, direct, and sequential instructions can help prevent vulnerabilities.

Implement observability for proactive cybersecurity

As the DOS’s software factories continue to develop and deploy new technologies, the agency must adopt methods that allow it to keep close tabs on how those technologies connect and interact with one another. Implementing a process of observability is a good way to accomplish this task.

Observability provides a complete view of every asset that comprises an organization’s IT infrastructure, whether on-premises, in the cloud, or hybrid environments. IT teams can observe how assets operate and interact with each other and rapidly identify issues as they arise, including potential security risks.

Observability goes beyond traditional network monitoring, but both are essential. The latter pushes alerts to IT teams whenever there’s a deviation from a predetermined metric, while the former allows teams to detect and analyze abnormalities in real time. So, while monitoring is reactive, and observability is proactive, both work together to form a critical foundation for infrastructure security.

Take an “assume breach” mentality

Zero-trust is an effective best practice that the DOS has adopted from the Department of Defense’s leadership. In the wake of continually evolving cybersecurity threats, adopting a zero-trust posture should be considered the minimum protection standard.

The DOS can take this approach even further by taking an “assume breach” mentality. An assume breach mindset includes several strategies designed to protect the agency throughout the entire lifecycle of a cyberattack. In addition to incorporating zero-trust principles, assuming a breach involves:

Identifying and addressing gaps in security coverage
Planning how to react and respond to an attack
Detailing the steps needed to recover from an attack
Learning from an attack
Implementing processes to prevent future attacks

Assuming a breach is just as it sounds—embracing a position that it’s not if a breach will happen, it’s when it will take place. If agencies base their cybersecurity efforts around this mentality, they will be more prepared to both deal with and prevent the eventuality.

Cyber resiliency must be a top focus as the DOS continues its push toward modernization, but without a systematic plan in place, the agency’s efforts to contain and prevent vulnerabilities can easily become overwhelming. Adhering to the three strategies outlined here can help the DOS prioritize cybersecurity and tackle potential threats in a way that will not only protect the organization but also do so in a manner that is efficient and effective.

These best practices are fundamental elements to SolarWinds’ Secure by Design approach, developed in collaboration with leading cybersecurity experts in the wake of the 2020 SUNBURST attack. It’s a solid blueprint for the DOS to refer to as it continues its modernization efforts.