Critical Infrastructure in Cybersecurity: Modernizing the Electric and Utilities Sector

Posted on by Alex Whitworth

After the ransomware attack on Colonial Pipeline in 2021 and other notable events, the presidential administration has diligently worked to improve the cybersecurity posture of critical infrastructure in the United States. Several Government agencies, such as the Department of Energy (DOE) Cybersecurity, Energy Security and Emergency Response (CESER), the National Security Agency (NSA), Cybersecurity Infrastructure Security Agency (CISA), and private sector Electric & Utility Industry have joined to refine and boost cybersecurity in the Electric and Utilities sector.

Standards for the Electric and Utility Sector

Since 2021, the White House has put forth the National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems, an initiative that aims to safeguard the critical infrastructure of the nation. The Memorandum specifies that the Electricity Subsector was the pilot effort in its Initiative. In acknowledgement of the Memorandum, at least 150 electric utilities have or will adopt operational technology (OT) and Industrial Control Systems (ICS) security and improved the visibility, detection and monitoring of critical electricity networks. Further reinforcing the memo, in March of 2023, the Presidential Administration announced a national cybersecurity strategy that strives to create a secure digital ecosystem reinforced with the National Cybersecurity Strategy.

Control systems experts that work with DOE CESER, CISA and the NSA have developed a set of ICS security considerations. These considerations aim to enhance and monitor the detection, mitigation and forensic capabilities for OT owners and operators.

The ICS/OT cybersecurity evaluating and monitoring technology guidelines are recommendations rather than mandates. They include but are not limited to:

Building technology for ICS networks with integration compatibility for ICS protocols and communications
Adding sensor-based continuous network cybersecurity monitoring, detection and facilitation of response capabilities for both ICS and OT
Creating a collective defense capability framework for software so that Federal Government partners and trusted organizations can share insights and detections
Utilizing passive deployment and isolation technologies to protect sensitive information
Securing technology against access credential misuse^[1]

These guidelines aim to improve system security and visibility with Government partners.

Financing the Security Movement

To help fulfill the National Security Memorandum promise, the current administration has released the Bipartisan Infrastructure Law, which authorizes up to $250 million to enhance the cybersecurity resilience of rural, municipal, and small private electric utilities. The Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance (RMUC) Program has utilized the law to help improve energy systems, processes, assets, incident response and cybersecurity skills in eligible agencies within the utility workforce. Nearly one in six Americans live in remote or rural communities with inadequate funding and infrastructure for updated technology and modern systems.^[2] The RMUC Program pledges financial and technical assistance to help these communities, as well as small investor-owned electric utilities, to improve vital security functions such as operational capabilities and to provide cybersecurity services access and threat-sharing programs. In August 2023, the program pledged a prize pool of $8.96 million dollars in competitive funding and technical assistance to enable municipal and small investor-owned utilities to advance their training and cybersecurity.^[3]

By ensuring secure and reliable power to all customers, RMUC will help finance cybersecurity, as well as help fulfill another of the current administration’s goals of a net-zero carbon economy by 2050.

Cleaning Up Energy

In developing the clean energy sector, the Administration aims to mold the digital ecosystem to be more defensible, resilient and aligned with American values. This strategy will invest in the future by defending the energy sector and reinforcing clean-energy critical infrastructures.^[4] To aid in the battle for clean energy through cybersecurity innovation, Clean Energy Cybersecurity Accelerator (CECA) will make cybersecurity accessible via collaboration with public and private expertise. To do so, CECA will assess all ICS assets that are connected to a utility’s infrastructure. Any ICS with potential wide-reaching impact is evaluated against physical and virtual attacks in a test lab, allowing CECA to mend any security holes. Aiming to achieve carbon-free electricity by 2035, the DOE has announced hundreds of funding opportunities, including funding for the Fossil Energy and Carbon Management (FECM) office.^[5]

Through the collaboration of several key Government agencies and the tech industry, the Electric and Utilities sector is on the way to being secure, reliable and accessible to all.

The first two parts of this four-part blog series covered the basics of critical infrastructure cybersecurity, as well as an overview of the Water and Wastewater Sector. Following this third part, the fourth and final blog will dive deeper into the Transportation sector.

To learn more about how agencies can bolster their cybersecurity efforts within critical infrastructure, visit Carahsoft’s Cybersecurity Solutions Portfolio.

Sources

[1] “Considerations for ICS/OT Cybersecurity Monitoring Technologies,” Office of Cybersecurity, Energy Security and Emergency Response, https://www.energy.gov/ceser/considerations-icsot-cybersecurity-monitoring-technologies

[2] “Biden-Harris Administration Launches $250 Million Program to Strengthen Energy Security for Rural Communities,” Department of Energy, https://www.energy.gov/articles/biden-harris-administration-launches-250-million-program-strengthen-energy-security-rural

[3] “New Prize Supports Rural and Municipal Utilities in Strengthening Cybersecurity Posture,” NREL, https://www.nrel.gov/news/program/2023/new-prize-supports-rural-and-municipal-utilities-in-strengthening-cybersecurity-posture.html

[4] “Fact Sheet: Biden-Harris Administration Announces National Cybersecurity Strategy,” The White House, https://www.whitehouse.gov/briefing-room/statements-releases/2023/03/02/fact-sheet-biden-harris-administration-announces-national-cybersecurity-strategy/

[5] “Funding Notice: Critical Materials Innovation, Efficiency and Alternatives,” Energy.gov: Office of Fossil Energy and Carbon Management, https://www.energy.gov/fecm/funding-notice-critical-materials-innovation-efficiency-and-alternatives

Empowering Citizens: The Next Frontier in Government Service Delivery

Posted on by Josh Green

In this era of rapid technological advancement, embracing digital transformation is not just a matter of convenience, but a necessity for ensuring government agencies can effectively serve their constituents. The convergence of policy directives, like the President Management Agenda and the 21st Century IDEA (Integrated Digital Experience Act), with the pioneering spirit of public servants, sets the stage for a new era of government-citizen interaction.

Personalized Government Experiences

As we reflect on the lessons learned over the last few years, it becomes clear that the digital shift was not just about replicating existing services in a virtual space, it was about reimagining the very essence of citizen engagement itself. Agencies pivoted swiftly, using technology to supply critical services while safeguarding public health. This showed the immense potential for innovation within the public sector. The digitization of vital services, from health updates to unemployment assistance, was a monumental first step. Now, agencies stand at the precipice of a new frontier: personalization. Imagine a government service experience that predicts and addresses the unique needs of each individual. It is not just a matter of efficiency; it is a statement of commitment to inclusivity.

Accessibility, often considered a compliance requirement, is at the core of this transformation. Yet, true accessibility encompasses more than technical compliance. It demands a cultural shift towards empathy and understanding. It calls for dedicated teams to champion accessibility at every stage of service delivery. It challenges agencies to view every interaction as an opportunity to forge a deeper connection with citizens.

Looking ahead, the potential for government-citizen interactions is boundless. The fusion of technological innovation and policy imperatives opens a realm of possibilities. From predictive analytics that anticipate citizen needs to virtual assistants that guide individuals through complex processes, the future is bright with potential. In this quest for personalized government experiences, creating tailored content emerges as a pivotal strategy. This involves understanding the diverse needs and preferences of citizens and crafting information that resonates with them on a personal level. By using data analytics and user insights, agencies can quickly and automatically curate content that addresses specific challenges, provides relevant information, and guides individuals seamlessly through their interactions with government services.

Digital Workforce

Furthermore, the power of personalization extends beyond citizens to the dedicated employees within government agencies. A digitally empowered workforce is fundamental to delivering exceptional public services. Agencies can invest in training and upskilling programs, equipping employees with the digital tools and knowledge necessary to navigate the evolving landscape. By fostering a culture of continuous learning and innovation, agencies empower their teams to adapt to changing citizen needs and drive meaningful impact. Empowering employees goes hand-in-hand with enhancing the experiences of constituents. By streamlining internal processes and using technology, agencies can reduce bureaucratic hurdles and deliver services more efficiently. This not only improves the speed of service delivery but also frees up resources to focus on initiatives that truly matter to citizens.

Seeking feedback from both employees and constituents is instrumental in fine-tuning government services. Establishing open channels of communication allows agencies to gain valuable insights into pain points, preferences, and areas for improvement. This iterative approach fosters a culture of responsiveness, ensuring that government services evolve in tandem with the evolving needs of the community.

A Citizen-Centric Government for All

The pursuit of personalized government experiences is a multifaceted endeavor. It requires a comprehensive approach that encompasses the creation of tailored content, the empowerment of employees, and a relentless commitment to continuous improvement of these experiences. As agencies embark on this transformative journey, they not only meet the immediate needs of citizens but also set the stage for a more agile, responsive, and citizen-centric government in the years to come.

Overall, the journey towards personalized government-citizen experiences is not just a matter of policy compliance, but a testament to the ideals of a government that serves all its citizens equitably. By championing accessibility, agencies pave the way for a more inclusive society. By embracing personalization, they empower individuals to engage with their government on their own terms. Together, we embark on a transformative journey towards a more responsive, inclusive, and citizen-centric government.

Check out this four-part Adobe webinar series to learn more about creating simplified government experiences customers can count on.

Okta and ServiceNow: Modernizing Public Sector Operations

Posted on by Matt Egan

Federal, state, and local agencies and educational institutions are facing a surge in targeted cyberattacks. With increasing return-to-office mandates, they face further challenges balancing security with the need to deliver frictionless experiences for users and systems, both within and beyond the premises of agencies and campuses. Public sector organizations can lean further on industry partners to help them modernize operations to improve cybersecurity, support distributed workforces and users, remain compliant with audit and policy mandates, and, ultimately, better serve the public.

Roadblocks to Modernization

To modernize operations, agencies and institutions need to transition from legacy systems to cloud-based tools. Creating collaborative, seamless, and secure work environments that not only attract and retain top talent but also comply with key audit and policy mandates is necessary.

But building this kind of robust environment that can securely support mission-critical work isn’t easy.

Okta ServiceNow Modernizing Public Sector Operations Blog Embedded Image 2023

For one, as the public sector implements cloud-based tools that deliver modern, continuous digital services, they must also ensure the new technology works seamlessly alongside existing processes. And securing work environments both in-office and remotely has never been more challenging, with a 40% increase in cyberattacks against government and public service organizations from Q2 2023 to Q3 2023. Unfortunately, busy IT teams’ resources are too often spent completing manual work instead of implementing changes needed to focus on the high-value work that propels their missions.

How Okta and ServiceNow Solutions Help With Modernization and Automation

Okta and ServiceNow solutions enable agencies and institutions to overcome these obstacles by providing tools that enhance security, modernize operations, comply with strategic policies, and improve service delivery to meet critical mission goals.

Together, Okta and ServiceNow help with:

Identity and access management: A centralized Identity solution offers a complete view of users and phishing-resistant authentication to protect accounts from cyberattacks and least-privilege access. This gives users just the right access at the right time for the right purposes.
User lifecycle and workflow automation: Advanced algorithms and customizable templates streamline onboarding and offboarding for IT teams, reducing time-consuming work, eliminating manual, repetitive tasks, and increasing productivity.
Compliance and policy oversight: Detailed logs and refined reporting capabilities perform automated compliance checks, and policy enforcement mechanisms help reduce the risk of non-compliance.
No-code automation: No-code/low-code automation enables IT teams to quickly launch modern services while still adhering to Zero Trust integrations.
Risk management and monitoring: Advanced analytics and real-time reporting enable continuous visibility of all systems, improving service availability and accelerating incident response that can better protect the sensitive information of public sector organizations.
System integration: API management and middleware tools enable seamless integration with automated data exchange to improve communication and reduce errors.

Why Okta and ServiceNow are Better Together

These solutions combine ServiceNow’s expertise in policy and compliance management and internal and vendor risk management with Okta’s expertise in Identity and access management, such as single sign-on (SSO) and multi-factor authentication (MFA).

More specifically, with a rich, bidirectional integration, Okta and ServiceNow work seamlessly together, empowering public sector organizations to modernize and automate their services to support their evolving missions with:

Okta Integration Network (OIN)
ServiceNow Security Incident Module
StateRAMP Ready authorization
FedRAMP High authorization
Department of Defense Impact Level (IL) 4 and IL5 workloads

Contact our team today to learn more about about how, together, Okta and ServiceNow provide the public sector with an open, future-ready platform to automate, secure, orchestrate, and simplify their workflows.

Software, AI, Cloud and Zero Trust as Top Priorities for the Army and DoD at Large at TechNet Augusta 2023

Posted on by Mike McCalip

Many of the major cybersecurity, data, DevSecOps and other trends from the past couple of years continue to grow and be top priorities for every segment of the Department of Defense (DoD). At TechNet Augusta 2023, Government and industry experts shared the specific needs of their organizations across those areas and solutions to help achieve their goals. The main theme of the event was “Enabling a Data-Centric Army” and expanding those principles and their mobilizing technologies to the entire DoD. For the Army in particular, the shift from hardware to software, the use of artificial intelligence (AI), cloud capabilities and Zero Trust were headlining topics at the conference.

Shifting from Hardware to Software

In an effort to increase agility and expand access to resources, the Army is transitioning its equipment from hardware to software. Amending its materiel release process to decouple software from hardware allows the Army to deploy software outside of the long hardware acquisition cycle. To mobilize this endeavor, the Army Futures Command (AFC), is modifying its software requirements to focus on high-level overviews that are then refined by operators. Alongside this shift, the Army and other departments requested that technology providers ensure that their software solutions integrate with each other. Going forward, the Army also asked industry to provide software that is not tied to specific hardware. This separation will be key to establishing data-centricity. Nearly every speaker echoed the importance of this shift for their departments.

Utilizing AI

With this major transition to a software-heavy environment, Army Chief Data and Analytics Officer David Markowitz believes it will be an ideal use case for generative AI in software development. Having a controlled environment in software development would make it easier to properly govern compared to the complexity of some of the other uses. As AI usage increases across the DoD, military leaders requested industry create AI platforms with layered complexity of features enabling users of any skill level to utilize the technology effectively. In regard to AI applications for data, Army CIO Leonel Garciga stated that additional guidance on “Data Use on Public/Commercial Platforms” would be released soon to clarify its policy. Overall, officials concurred that the DoD is not looking to become 100% reliant on AI aid but instead maximize AI’s strengths to augment human critical thinking and empower commanders to make data-driven decisions.

Enabling Cloud Capabilities

Over the past year, the Army has exponentially increased its cloud migration and virtualized capabilities. Housing information in the cloud optimizes data storage and simplifies ease of access particularly with the increase in data output, and the push for AI data analytics and data-driven decisions. Hybrid cloud solutions offer the readiness, adaptability and duplication of vital information necessary for military operations to continue smoothly in any situation. Currently, DoD leaders seek industry solutions for modernizing and moving applications to the cloud simultaneously. Acquiring technology with this ability would reduce both the security risk and the work required from the military to implement it.

Expanding Zero Trust

Overarching every aspect of the DoD is the critical need for cybersecurity. Garciga plans to emphasize Zero Trust implementation heavily in conjunction with improving user experience and cyber posture. While multi-factor authentication offers a great starting point, military leaders explained that it is not enough and that they look to partner with industry to close virtualization vulnerabilities through continuous monitoring and regular red teaming. At the conference, the Army Cyber Command (ARCYBER) outlined seven principles for IT providers to follow for all capabilities they deliver:

Rapidly Patch Software
Assess All Production Code for Security Flaws
Improve Security of Development Networks
Isolate Development Environments from the Internet and from the Vendor Business Network
Implement Development Network Security Monitoring
Implement Two-Factor Authentication (2FA) on Development Network and Testing Services
Implement Role-based Permissions on Development Network

Empowering DoD Success

A consistent thread woven throughout the event was the vital nature of open communication and partnership between the DoD and technology companies to achieve the established goals. Within each of these areas including the shift from hardware to software, use of AI, cloud capabilities and Zero Trust, the DoD looks to innovate and explore new methods and solutions to stay ahead on the world platform. Together through collaboration, industry can have a vital role in keeping American citizens safe one technology update at a time.

Explore our Federal Defense Technology Solutions Portfolio to learn how Carahsoft can support your organization through innovative, agile defense resources and IT capabilities.

*The information contained in this blog has been written based off the thought-leadership discussions presented by speakers at TechNet Augusta 2023.*

Three Strategies for Minimizing Insider Threats

Posted on by Chip Daniels

Insider threats (alternatively known as careless or untrained insiders) continue to be a problem for the public sector. According to SolarWinds 2023 Public Sector Cybersecurity Survey, 68% of respondents cited careless or untrained employees as one of the highest sources of security threats, second only to foreign governments.

Insider threats have continued to increase over the past few years. Mobile work has become commonplace, and more employees have begun using unsanctioned applications, leading to incidents of shadow IT. Meanwhile, hackers have become adept at targeting government employees through phishing and ransomware attacks, which succeed due to human error.

Educating your employees about the dangers of these attacks and putting in proper safeguards to prevent them is critical. Here are three strategies to help employees become more aware of threats and build a better security posture from the inside.

Understand while not everyone is a trained security expert, everyone can play their part

SolarWinds Cybersecurity Against Insider Threats Blog Embedded Image 2023

Some organizations tend to say, “Everyone is responsible for cybersecurity,” which is not entirely true. An employee in charge of processing applications for social security benefits is in charge of processing applications for social security benefits, not protecting the agency from a cyber attack.

However, there are little things everyone can do to prevent threats–they just need to know what those things are. It’s more than not opening emails from unknown senders or clicking on suspicious-looking attachments. It’s being vigilant, even when someone is feeling overworked. It’s also knowing who to report these incidents to if and when they occur and how and when to share information with colleagues about potentially suspicious activity.

Other things you can do to help employees protect your agency include:

Implementing company-wide password protocols, including two-factor authentication
Mandating employees to change their passwords every few months
Adding context to communications around cybersecurity to help employees understand the ramifications of cybersecurity incidents (for example, illustrating how a breach could impact employees’ jobs)

While rigorous training isn’t necessary, you can aim to make safe security practices a part of your day-to-day efforts. For example, periodic email reminders, replete with simple and easy-to-follow best practices and sent from the CIO or security team, can help improve your organization’s security posture.

Conduct simulations to help employees understand how to respond to possible threats

Email reminders are important, but nothing beats practicing what to do in the event of a threat. Which is where Breach and Attack Simulations (BAS) come in.

BASs can be used to simulate just about any type of attack your employees might be exposed to, including phishing, malware, and more. Employees are asked to spot, respond to, and prevent an attack in a simulation. Managers can assess employees’ responses and reactions and discover where more education is needed.

Simulated attacks are also great for increasing employee vigilance and education. The more employees are exposed to simulated threats, the more knowledgeable they become about those threats–and the less likely they will be to fall prey to them.

Build a zero-trust foundation that is secure by design

While employees should always be your first line of defense against cyberattacks, no defense is ever foolproof, even those that have been adequately trained and prepared. Implementing a secure by design zero-trust cybersecurity environment can ensure weaknesses aren’t exploited.

In a secure-by-design environment, security is inherent in every aspect of the organization. Employees are aware of possible cybersecurity risks and know how to prevent them. Security is baked into the agency’s technology infrastructure and software development processes, and all technologies an agency procures have security as a standard feature, not an add-on.

Security by design goes hand-in-hand with zero trust. Zero-trust cybersecurity models are based on an “assume breach” mentality, where every request to access information could pose a threat. Therefore, all requests must be carefully verified, and all employees should only have access to the information they need.

Remember: while employees can be your agency’s best defenders, they’re also human. They can and will make mistakes. It’s essential to put in place safeguards to mitigate those mistakes. Education is important, but so is having a backup plan in case something fails. By covering all angles you’ll have a better chance of preventing the next employee-centric cyberattack.

For more guidance on how to better enhance your agency’s cybersecurity posture, visit SolarWinds’ Secure by Design resource center.

Innovation in Government: The Future of Technology with Dell

Posted on by Erica Raymond

Advances in communications, data analytics and cloud ecosystems are supercharging efforts to modernize government. Leaders recognize that partnerships with industry are essential to their success with emerging technologies, including groundbreaking tools and techniques that help agencies tackle a wide array of challenges. The government is facing monumental challenges, such as the economy, climate change, public health and military preparedness. These large-scale, broad impact problems require new and innovative ideas to solve. Organizations such as the Computing Technology Industry Association (CompTIA) and the National Institute of Standards and Technology (NIST) have released guidance and strategies for agencies hoping to move past existing restrictions by updated legacy systems. Carahsoft’s most recent Innovation in Government Report includes insights from industry experts at Dell Technologies on how emergent technologies can help government push past those boundaries, with deep dives on 5G, artificial intelligence, digital twins, edge computing and cloud ecosystems.

A Secure Way to Use AI-Assisted Data Analytics

“Federated learning is becoming increasingly relevant given the emergence of ChatGPT and other AI-based technologies. Industry and government leaders recognize that it is essential to develop AI in an ethical, unbiased way that ensures information privacy and security. The only way to do that is to take a critical look at the technologies that are evolving and shape them in an intentional way. Right now, AI is not as secure as it could be. It is susceptible to the same vulnerabilities that affect other technologies. Therefore, agencies and their industry partners should focus on protecting data where it resides, instituting a zero trust architecture and securing AI algorithms.”

Read more insights from Ed Hicks, business development manager for federal and AI at Dell Technologies.

What the Evolution of 5G Means for Government

“5G is the first generation of cellular technology that’s cloud native, which means it has the flexibility to be fully virtualized and deployed in several different architectural designs, hosted on commercial servers. Agencies now have the ability to dynamically scale up or down depending on the network load at the moment. In addition, many large hyper-scaler cloud vendors are exploring ways to provide 5G as a service and combine the virtualized network function with cloud-hosted workloads, integrating the telco workload into the traditional IT stack.”

Read more insights from Greg Burrill, 5G/Networking Alliance Manager at Dell Technologies.

Taking Modernization to the Next Level with Digital Twins

“Digital engineering is digital transformation applied to the realm of systems engineering. It is another path to IT modernization. Digital twins require the foundations of a digitally transformed environment and its elements of data management, agile development, DevSecOps and container-based orchestration. Digital twins focus on bringing data from the physical world into the digital arena, gleaning insights through artificial intelligence and then displaying those insights visually for users. Digital twins can deploy those conclusions in the physical world, measure the results of the changes and start the loop over again by feeding that data back into the digital arena.”

Read more insights from Ken Rollins, Technology Architect for Digital Engineering/Edge at Dell Technologies.

How Repatriation Fits into a Broader Cloud Strategy

“When agencies simply lifted and shifted workloads into the cloud, they often experienced inefficiencies and cost overruns. Now that agencies are gaining a better understanding of cloud models and how to adapt their workloads to run efficiently in the cloud, they have begun to more carefully consider when it makes the most sense to put a workload into a public cloud and when it is better to pull it back to run on premises, known as cloud repatriation. Those decisions should be part of a larger strategy for appropriate workload placement.”

Read more insights from Manny Yusuf, Chief Cloud/Edge Architect at Dell Technologies.

Future-Ready Data Centers for Government Agencies

“A software-defined data center (SDDC) virtualizes all the infrastructure elements that government agencies are using and delivers them in an as-a-service model. Specifically, compute, networking, storage, security and services are abstracted and delivered as automated, policy-driven software. That virtualized, programmatic approach enables SDDCs to break down IT silos and simplify complexities. The benefits include gains in performance and availability and reductions in costs and security risks. An SDDC enables applications to be deployed more quickly and IT resources used more effectively through the use of cloud-based services.”

Read more insights from Manny Yusuf, Chief Cloud/Edge Architect at Dell Technologies.

A Flexible Cost Model for Cloud and Infrastructure

“Maintaining visibility into IT operations is crucial for understanding and mitigating security risks as well as for better managing costs. Agencies might need to achieve a specific return on investment, meet certain efficiencies or comply with unique mission requirements. Regardless of the goal, a simplified cost model provides a comprehensive understanding of what it costs the agency to run workloads on premises, at the edge or in any cloud location. Dell APEX also allows agencies to maintain oversight of their IT environment and expenses when they are running a software factory and pushing out new capabilities on a continuous basis. Anytime something new is put in the cloud, it’s important to have visibility into its long-term costs so that agencies can avoid inefficiencies.”

Read more insights from Manny Yusuf, Chief Cloud/Edge Architect at Dell Technologies.

Download the full Innovation in Government® report for more insights from emerging technology thought leaders and additional industry research from FCW.

Securing the Digital Workplace: Microsoft 365 Identity Management for Public Sector Leaders

Posted on by Antoine Snow

Zero Trust is a critical focus for public sector organizations as they navigate today’s evolving digital workplace and cybersecurity landscape. But one issue is emerging as increasingly troublesome: insider threats.

The 2022 Cost of Inside Threats: Global Report found incidents involving insider threats surged 44% over the past two years. While some of these threats may be malicious insiders, seeking to misuse their authorized access for personal gain or harm, many are the result of cybercriminals exploiting vulnerabilities in identities to enter your environment. These criminals use tactics like compromised credentials – the leading cause of data breaches – as well as phishing scams and social engineering to impersonate identities and gain unauthorized access.

To effectively counter these increasingly sophisticated threats, organizations must strengthen identity management. When executed properly, identity management not only enhances the security of your digital workplace but enables a Zero Trust strategy.

Let’s discuss what identity management is, how to build a comprehensive strategy in Microsoft 365, and how it can fortify your Zero Trust deployment.

What is Identity Management?

AvePoint Identity Management Blog Embedded Image 2023

Identity management establishes and manages the digital identities of anyone entering your environment – from employees and contractors to guest users. Identities could refer to people, but they could also be services or devices entering your environment.

Identity management enables organizations to implement robust access controls, granting privileges based on roles – which is why identity management is an integral piece of Zero Trust. Without it, you will have no way to verify users and devices are who they say they are, let alone establish proper privileges and access, which are key Zero Trust principles.

When done effectively, identity management provides the right access to the right individuals at the right time for the right reason. This process not only improves your security posture, but can streamline user access, reduce administrative overhead, and help you better meet your compliance obligations.

Building Identity Management in Microsoft 365

When building your identity management strategy in Microsoft 365, remember these three basic elements: identify, authenticate, and authorize.

Here’s how to get started:

Identify: The backbone of identity management in Microsoft 365 is Azure Activity Directory (Azure AD). Azure AD provides a cloud identity for users, groups, and resources. It is where you build out your users’ identities and control access to internal and external resources – like your intranet or even Microsoft Teams. The solution will recognize users (based on Microsoft’s powerful machine learning and AI’s understanding of typical user and tenant behavior) and flag risks that fall outside of normal behavior, triggering the next steps of the process.
Authenticate: Multi-factor authentication (MFA) is today’s gold standard for authenticating identities. There are a variety of ways to do this, from smart cards to one-time passwords, that add layers of protection to your security. Microsoft’s Authenticator App helps implement MFA across your applications in a convenient and easy way for users, allowing them to verify their and their devices’ identities from their phones.
Authorize: It’s critical to grant access privileges based on the conditions specific to your organization. Conditional Access policies take a two-phased approach: first, it collects information about the person (their device, IP address, etc.) and then enforces any policies you have in place. This could mean if it detects a new device, it may enforce multi-factor authentication (MFA) or request the user sign in again. It could also prohibit access under certain conditions, like if a user is attempting access from a mobile device. These policies provide granular control over access while reducing the risk of authorized access.

By following this framework, you can easily begin using the powerful tools Microsoft offers to build your identity management strategy, ensuring only authorized individuals have access to critical systems.

Three Ways to Take a More Proactive Approach to Identity Management

Once you’ve taken the initial steps to start building your identity management approach, take it to the next level to enhance your security:

Right-size your policies: Strict, one-size-fits-all rules can hinder productivity; if security is in the way of getting the job done, users will find a way around it. Customizing your policies to specific users, workspaces, or even content creates a more tailored approach to access control, striking a balance between security and productivity.
Implement lifecycles: Identities should not permanently exist in your environment. People switch jobs or upgrade their devices. Establish a process to evaluate and recertificate identities – whether users (both external and internal) or devices – to ensure they still require access to your content and workspaces.
Monitor your environment: Even with the best-laid security plans, things can still fall through the cracks. That’s why it’s critical to monitor your environment – including users, devices, locations, and behavior – to identify any anomalies or suspicious activities that should be addressed.

These strategies can help you build a more proactive identity management approach that actively reduces risks and attack surfaces, allowing you to go beyond verifying identity to create a secure and efficient digital workplace.

Build a Secure Digital Workplace with Zero Trust

While identity management is an important aspect of building your secure digital workplace, ensuring only authorized individuals have access to your systems, it is not enough to protect your data or the workspaces where it lives in today’s ever-evolving cyber threat landscape.

Public sector organizations must embrace a comprehensive Zero Trust security framework to effectively build a secure digital workplace. To do so, you must combine identity management best practices with other robust security measures, like role-based access controls, workspace governance policies, lifecycle management processes, and risk assessments. Together, these strategies can enhance the protection of your digital environment and minimize your risk of data breach or unauthorized access.

Download the free AvePoint guide, “How to Achieve Zero Trust Standards Without Limiting Collaboration in Microsoft 365,” for more information about protecting your digital collaboration workspaces with a Zero Trust framework.

FedRAMP Rev. 5 Baselines are Here, Now What?

Posted on by Anil Karmel

The FedRAMP Joint Authorization Board (JAB) has given the green light to update to FedRAMP Rev. 5. With this revision, FedRAMP baselines are now updated in line with the National Institute of Standards and Technology’s (NIST) SP 800-53 Rev. 5 Catalog of Security and Privacy Controls for Information Systems and Organizations and SP 800-53B Control Baselines for Information Systems and Organizations. This transformation brings opportunities and challenges for all stakeholders involved, including Cloud Service Providers (CSP), Third Party Assessment Organizations (3PAOs), and Federal Agencies. But worry not – with RegScale, we have your back! Let’s dive in and understand the impact and how to prepare for the coming changes.

Decoding the Transition

The transition has been in the works for a very long time, and FedRAMP has updated many of their controls to accurately reflect updates in technology since Rev. 4 was published in 2015. FedRAMP Rev. 5 brings with it significant updates to the security controls to meet emerging threats, including new families such as supply chain risk management, and places a greater emphasis on privacy controls. FedRAMP continues to strongly encourage package submission in NIST Open Security Controls Assessment Language (OSCAL) format to accelerate review and approval processes. To aid with a clear comprehension of the updates, FedRAMP has also released a Rev. 4 to Rev. 5 Baseline Comparison Summary. There are more than 250 controls with significant changes, including several whole new families of controls.

In the coming weeks, FedRAMP plans to release a series of updated OSCAL baseline profiles, resolved profile catalogs, System Security Plan (SSP), Security Assessment Plan (SAP), Security Assessment Report (SAR), and Plans of Action and Milestones (POA&;ampM) templates as well as supporting guides for each of these.

What is OSCAL, You Ask?

RegScale FedRAMP Rev. 5 Baselines Blog Embedded Image 2023

OSCAL is a set of standards for digitizing the authorization package through common machine-readable formats developed by NIST in conjunction with the FedRAMP PMO and industry. NIST defines it as a “set of hierarchical, formatted, XML- JSON- and YAML-based formats that provide a standardized representation for different categories of security information pertaining to the publication, implementation, and assessment of security controls.” OSCAL makes it easier to validate the quality of your FedRAMP packages and expedites the review of those packages.

The Impact on CSPs

FedRAMP has published the CSP Transition Plan, providing a comprehensive roadmap and tool for CSPs to identify the scope of the Rev. 5 controls that require testing and offering support for everyone based on their stage in the FedRAMP authorization process. Timelines for the full transition range from immediate to 12-18 months. You should find a technology partner to assist you regardless of your FedRAMP stage so that you can quickly and completely adapt from Rev. 4 to Rev. 5 baselines as well as update, review, and submit your packages in both human-readable (Word, Excel) and machine-readable (OSCAL) formats.

If you are a CSP just getting started with your FedRAMP journey…

As of May 30, 2023, CSPs in the “planning” stage of FedRAMP authorization must adopt the new Rev. 5 baseline in their controls documentation and testing and submit their packages in the updated FedRAMP templates as they become available. You are in the planning phase if you are:

Applying for FedRAMP or are in the readiness review process
Have not partnered with a federal agency prior to May 30, 2023
Have not contracted with a 3PAO for a Rev. 4 assessment prior to May 30, 2023
Have a JAB prioritization but have not begun an assessment after the release of the Rev. 5 baselines and templates

If you are a CSP in the “Initiation” phase

CSPs in the initiation phase will complete an Authority to Operate (ATO) using the Rev. 4 baseline and templates. By the latest of the issuance of your ATO or September 1, 2023, you will identify the delta between your Rev. 4 implementation and the Rev. 5 requirements, develop plans to address the differences, and document those plans in the SSP and POA&;ampM. You are in the initiation phase if any of the following apply prior to May 30, 2023:

Prioritized for the JAB and are under contract with a 3PAO or in 3PAO assessment
Have been assessed and are working toward P-ATO package submission
Kicked off the JAB P-ATO review process
Partnered with a federal agency and are:
- Currently under contract with a 3PAO
- Undergoing a 3PAO assessment
- Have been assessed and have submitted the package for Agency ATO review

If you are a Fully Authorized CSP

You are in the “continuous monitoring” phase if you are a CSP with a current FedRAMP authorization. By September 1, 2023, you need to identify the delta between your current Rev. 4 implementation and the Rev. 5 requirement, develop plans to address the differences and document those plans in the SSP and POA&;ampM. By October 2, 2023; you should update plans based on any shared controls.

If your latest assessment was completed between January 2 and July 3, 2023, you have a maximum of one year from the date of the last assessment to complete all implementation and testing activities for Rev. 5. If your annual assessment is scheduled between July 3 and December 15, 2023, you will need to complete all implementation and testing activities no later than your next, scheduled annual assessment in 2023/2024.

A Complete Technology and Transition Partner

The transition to FedRAMP Rev. 5 is not just about meeting the new requirements but doing so in the most efficient and seamless manner. You should focus on your core business while technology like RegScale handles the intricacies of the compliance transition.

Beyond compliance documentation, RegScale serves as a comprehensive FedRAMP compliance technology and transition partner. Our platform assists with mapping your security controls against FedRAMP and NIST SP 800-53 baselines for Rev. 4 and Rev. 5, supports gap analysis, provides remediation support, and enables continuous monitoring and improvement. The platform currently includes FedRAMP support and tools to develop human-readable and OSCAL-formatted content for Catalogs, Profiles, SSPs, Components, SAPs, SARs, POAMs and Asset Inventory. To help eliminate the friction and confusion of where to begin with OSCAL, RegScale provides an intuitive Graphical User Interface (GUI) to build artifacts using our wizards and then easily export them as valid OSCAL. By automating the creation of audit-ready documentation and allowing direct submission to the FedRAMP Project Management Office (PMO) through OSCAL and/or Word/Excel templates, RegScale provides a seamless transition experience to Rev. 5, reducing complexities and saving you valuable time and resources.

In closing, it is crucial for all CSPs and stakeholders to review the new mandates and the CSP Transition Plan and begin planning to address the updated templates. Let RegScale help make the shift to FedRAMP Rev. 5 a streamlined, efficient, and effective process with minimum costs and business disruptions.

This post originally appeared on Regscale.com and is re-published with permission.

View our webinar to learn more about the low-cost approaches for handling the transition to Rev 5.

Security Protections to Maximize the Utility of Generative AI

Posted on by Tim Balog

Since the introduction of ChatGPT, artificial intelligence (AI) has exponentially expanded. While machine learning has introduced many merits, it also leads to security concerns that can be alleviated through several key strategies.

The Benefits and Risks of Generative AI

The primary focus of AI is to use data and computations to aid in decision-making. Generative AI can create text responses, videos, images, code, 3D products and more. AI as a Service, cloud-based offerings of AI, helps experts get work done more efficiently by advancing infrastructure at a quicker pace. In contrast, AI is also commonly used by the general public as a toy, since its responses can sometimes be entertaining. The comfort users have with AI and wide range of inputs introduces risk, and these risks can proliferate exponentially.

There are several key concerns for Government agencies when utilizing generative AI:

Copyright Complications – AI content comes from many different sources, and that content may be copyrighted. It is difficult to know who owns the words, images or source code that is generated, as the AI’s algorithm is based on derivative information. The data could be open sourced or proprietary information. To combat this, users should modify rather than copy any information gained from AI.
Abuse by Attackers – Bad actors can utilize AI to execute more effective and efficient attacks. While AI is not yet self-sufficient, inexperienced attackers can use AI to make phishing attacks more convincing, personal and effective.
Sensitive Data Loss – Users have, either intentionally or unintentionally, input sensitive data or confidential information into Generative AI systems. It is easier to disclose sensitive information into AI prompts, as users may dissociate the risk from the non-human machine.

The many capabilities of AI entice employees to utilize it to support their daily tasks. However, when this includes introducing sensitive information, such as meeting audios for transcripts or unique program codes, security concerns ensue. Once data is in the AI’s system, it is nearly impossible to have it removed.

To protect themselves from security and copyright issues with AI, several large communications companies and school districts have blocked ChatGPT. However, this still carries risk. Employees or students will find ways around security walls to use AI. Instead of blocking apps, organizations should create a specific policy around generative AI that is communicated to everyone in the company.

Combatting AI Risks

One such policy method includes utilizing a Data Loss Prevention (DLP) solution. The DLP’s purpose is to detect and prevent unauthorized data transmission, and its capabilities can be applied to AI tools to mitigate these concerns. Its security parameters work through three main steps:

Discover – DLPs can detect where data is stored and report on its location to ensure proper storage and accessibility based on its classification.
Monitor – Agencies can oversee data usage to verify that it is being used appropriately.
Protect – By educating employees and enforcing data-loss policies, DLPs can deter hackers from leaking or stealing data.

DLP endpoints can reside on laptops or desktops and provide full security coverage by monitoring data uploads, blocking data copied to removable media, blocking print and fax options and covering cloud-sync applications. For maximum security, agencies should utilize DLPs that cover all types of data storage—data at rest, data in use and data in motion. A unified policy based on detection and response to data leaks will prevent users from misapplying AI and provide balance for secure operation.

While agencies want to stay competitive and benefit from AI, they must also recognize and take steps to reduce the risks involved. Through educating users about the pros and cons of AI and implementing a DLP to prevent accidental data leakages, agencies can achieve their intended results.

Broadcom is a global infrastructure technology leader that aims to enhance excellence in data innovation and collaboration. To learn more about data protection considerations for generative AI, view Broadcom’s webinar on security and AI.

People Plus Technology: Building a Resilient Federal Cyber Workforce

Posted on by Alex Whitworth

Filling cyber jobs in Federal agencies is complicated – it requires competing with industry salaries, retaining existing talent and navigating the Federal hiring process. It’s a far-reaching challenge that affects every agency – the administration knows that, the Office of Personnel Management knows that, and agency technology and human resources leaders know that. And federal C suite leaders realize how the government recruits, hires and retains people for cyber jobs has to change. In partnership with FNN, our Federal Cyber Workforce guide takes a look at what the government is doing to tackle this problem on a sweeping federal level and also on a more agency-specific level. We also get industry perspective on the technologies that affect cyber workforce resiliency. We hope it provides some guidance and help as your agency works to beef up its cybersecurity, both through investments in people and technology.

3 Key Rallying Points for a Resilient Cybersecurity Team

“Agencies are currently operating in a high-threat environment, but that doesn’t mean they can’t implement a reasonable amount of information assurance. It may not be perfect, but it doesn’t have to be. The idea is to make it so that adversaries have to work extremely hard to penetrate the infrastructure. The adversaries are good, but agencies can be better with a resilient cybersecurity team, said Mark Bowling, chief risk, security and information security officer for ExtraHop. The key to achieving this is to have a risk reduction perspective.”

Read more insights from Mark Bowling, Chief Risk, Security and Information Security Officer at ExtraHop.

Do not Wait for a Breach: Why to Adopt Proactive Approach to Cyber Resilience

“When most people talk about cyber resilience, they’re referring to post-breach recovery — the means, methods and speed with which an organization can get its systems and services back online after a cyber incident. But Felipe Fernandez, federal chief technology officer at Fortinet, views resiliency more holistically. His advice? Agencies need to take a proactive stance on cyber resilience and include not only recovery from breaches but also when their planning for non-malicious threats and other operational disruptions, including those associated with cloud-based services.”

Read more insights from Felipe Fernandez, Federal Chief Technology Officer at Fortinet.

Proactively Improve Digital Employee Experience Though Automation

“Digital modernization and the adoption of collaboration tools is supposed to make work easier, especially in a hybrid environment. Employees want the flexibility to be productive in whatever manner best suits them. Unresolved technology issues can impede productivity. In its latest survey of industry employees and IT professionals, Ivanti found that 49% of employees are frustrated with the tools they use and 26% are considering leaving their jobs because of that. Employee experience is a top priority in government right now, and employees are internal customers of an agency’s IT services. By improving their experience your agency can realize gains in productivity and retention.”

Read more insights from Mareike Fondufe, Product Marketing Director at Ivanti.

Download the full Expert Edition for more insights from these cyber workforce leaders and additional government interviews, historical perspectives and industry research.