Enabling the Mobile Workforce With Secure Forms and Electronic Signatures

Posted on by Pat Pulliam and Noah Campbell

In this era of a largely remote and globally distributed workforce, where most workers want to be productive wherever they are — and on any device — it’s crucial to secure every endpoint from any threat that could compromise the security, prosperity, and integrity of an organization and its critical infrastructure. This is particularly true for governments and regulated industries.

Secure Forms for Productivity and Security

Forms are essential to all organizations, as they are a part of all important business processes, and a vital element of the customer journey. Forms are essential to collect information, progress the next best action, and deliver services. As with any heavily relied-on technology, forms’ security must be top of mind. Traditionally, the answer to this demand has been to gate our most mission-critical forms and documents behind cumbersome desktop technology. In this way, stakeholders had peace of mind that the verification of signature authenticity, and document chain-of-custody, could be protected and maintained.

BlackBerry Adobe Electronic Signatures Blog Embedded Image 2024

However, today’s workforce demands more options. Modern technology enables forms, and their connected digital document workflows, to deliver an optimized and personalized experience for the user — all while maintaining strong authentication, privacy, security, and adherence to data governance policies. As organizations continue to accommodate increasingly complex models for remote productivity, digital document workflows must flex with the times. They must be designed, deployed, and dispatched using intuitive interfaces and automation, across a wide range of mobile devices.

BlackBerry and Adobe: Innovation for Secure Mobile Productivity

To accomplish this forms maturity journey, BlackBerry and Adobe have partnered to deliver an innovative and secure digital document-signing solution, for governments and regulated industries. By combining BlackBerry Unified Endpoint Manager (UEM) and Adobe Experience Manager Forms, the two industry leaders have created a solution that is designed for mobile devices, yet still meets the rigorous security standards required by governments and the world’s most demanding enterprises.

This partnership between BlackBerry and Adobe enables the following outcomes:

It’s now possible to fill and sign forms with a smart card (i.e., CAC, PIV) easily and securely, from any device, anywhere, without requiring a VPN (virtual private network)
Automatically maintain verified credentials in a secure keystore
Granular management and document tracking capabilities are backed by the most trusted and reliable security in the market
Employees can leave sensitive desktop computing technology behind, at home or the office, minimizing security risks while enhancing user convenience

BlackBerry UEM leverages private key certificates to secure the connection to Adobe Experience Manager Forms, allowing employees to complete and sign forms and other documents from anywhere, on their corporate-issued or BYO (bring your own) mobile devices, and without a VPN.

Leveraging Security as a Strategic Enabler for Productivity

Enhancing productivity requires adopting dynamic, responsive, and mobile-friendly forms solutions that are easy to use. Adobe Experience Manager Forms embraces this, while enabling organizations to modernize their data capture and digital document workflows into a seamless, agile user experience. It allows users to capture data and authenticated signatures, and integrates into back-end systems to automate manual workflows. Adobe Experience Manager Forms also allows users to move away from paper or static PDF forms, while also embracing multiple benefits, including:

Responsive modern forms: Embrace operational modernization with mobile responsive, web-based forms, on any device, at any point in the discovering, filing, and signing process.
Scalable authoring: With the ability to create reusable sections and templates, and an easy drag-and-drop interface, Adobe Experience Manager Forms allows organizations to streamline business processes across the enterprise at scale.
Meaningful customer conversations: Powerful data integrations with pre-fill and multi-language support automatically personalize forms and communications, and trigger the next-best action.
Automation: Adobe Experience Manager Forms enables you to start on one device, then save and resume on another, to make end-to-end customer journeys faster. This reduces cost and saves time. Mobile and web-based forms combined with smart, certificate-based signature tools and automated workflows, help eliminate paper and laborious manual processes.

These outcomes, which have previously been considered out of reach for governments and regulated industries, are made possible by the best-of-breed security, and intuitive user experience, of BlackBerry UEM.

Awarded the most government security certifications of any unified endpoint manager, and approved for both classified and unclassified use, BlackBerry UEM is trusted by organizations around the world. Customers that trust BlackBerry UEM to keep them always-on, and securely connected, include the federal governments of numerous countries around the world, including the Canadian and U.S. governments, and many of the largest and most prestigious players in the global financial services industry. Announced earlier this year, BlackBerry UEM was named a 2023 Customers’ Choice for unified endpoint management tools on Gartner® Peer Insights™ — the only UEM tool to receive the distinction this year.

Digital document workflows should not be limited to desktop environments. Business value can no longer be delayed or denied by lack of mobile support for securely completing and signing electronic documents. Productivity must not come at the cost of security. The innovative partnership between BlackBerry and Adobe holds the answer.

Contact a member of our team today to learn more about how, together, BlackBerry and Adobe can help modernize your organization with the most secure forms and electronic signature technologies.

The Best of What’s New in Mobility

Posted on by The Carahsoft Team

Many organizations have already invested significantly in projects that support mobility. The Center for Digital Government (CDG)’s 2021 Digital Cities and Digital Counties Surveys found that on average 85% of city respondents and 75% of county respondents are using location services, native mobile apps and text message/SMS channels. As organizations move forward with mobility, they should consider compute and storage capacity, end-to-end security, service design and delivery, and application rollout. Another important strategy is to have multiple options, so the organization can adjust to cost changes and inflationary pressures that could impact targeted business outcomes. Learn how your agency or municipality can move toward mobility in Carahsoft’s Innovation in Government® report.

Driving Innovation with Mobility

“It comes down to identity and Zero-Trust concepts. Strongly authenticating someone and having confidence in their identity is especially important as organizations work with sensitive or private information. Organizations need to consider how users move through sensitive data from a strong authentication and authorization standpoint. That brings us to Zero- Trust development models. How do you architect to create a safe landing space for people to come in and then traverse into legacy systems where critical information is stored? How do you set up safe, well-orchestrated and known boundaries, so employees and the public don’t have challenges when they try to access data? That’s critical in your systems.”

Read more insights from Red Hat’s Chief Architect and National Technology Adviser, Kevin Tunks.

Mobilizing Your Enterprise Securely

“The first challenge is education — understanding what mobile app security means; what the risks are; and what tools, techniques and processes should be employed. The second challenge is determining whether to build the program internally or leverage third parties. Setting up your own program and building a security team to do things like continuous testing, penetration testing, security analysis and supply chain risk management is costly and complicated. Most agencies are turning to commercial off-the-shelf packages or managed service providers that scan and vet mobile apps. Doing so provides instant intelligence on what security risks might live in those mobile apps, so organizations can decide whether to allow them.”

Read more insights from NowSecure’s Chief Mobility Officer, Brian Reed.

Addressing Today’s Mobile Threats

“A lot of Zero-Trust conversations today revolve around validating identity and making sure that a person is who they purport to be. However, if their device has a malicious payload when they’re granted network access, then all we’ve really done is identify that they were the source of the attack. We believe that when you validate the person’s identity, you must simultaneously do device attestation to validate the integrity of their device. Only then should the person be granted access to that particular resource or infrastructure. You can’t say you have Zero Trust if you haven’t attested the device. The two go hand-in-hand.”

Read more insights from Zimperium’s Vice President for Public Sector, Jim Kovach.

Moving from Mobile-First to Mobile-Only

“Organizations must secure all devices that process enterprise data. It’s important to look past “industry standard” protections of yesterday and embrace newer technologies that employ AI and machine learning to provide smarter, quicker and lighter-weight ways of protecting assets. In addition, it’s best to implement mobile-first architectures, 5G (as well as the anticipated 6G release) and cloud architectures simultaneously with their non-mobile infrastructure counterparts. Non-negotiables include yearly penetration testing, programs to review and test third-party applications within agency environments, and securing mobile devices as strongly as desktops. It’s also wise to ensure the security posture of cloud environments is equivalent to on-premises environments. Of course, securing data in transit and at rest is essential. Finally, end-to-end security can’t take a back seat to appeasing users’ demands.”

Read more insights from the BlackBerry Sales Engineering team.

Download the full Innovation in Government® report for more insights from these mobility thought leaders and additional industry research from GovTech.

Locking Down Information Management Security on Campus

Posted on by Tim Boltz

According to one report, ransomware attacks against higher education doubled in 2020 compared to 2019, with an average ransom demand of $447,000. Traditionally, criminals tended to be opportunists; they’d strike at random and hope to get lucky. Now they’ve organized into highly sophisticated networks and cartels that will target any entity of substance they consider a viable target. Higher ed fits the profile, but some institutions are better positioned to withstand cybersecurity attacks than others. A combination of zero-trust and defense-in-depth allows these schools to defend against malware and ransomware. Ultimately, the job of the cybersecurity professional in higher ed is to “plan for the worst day,” as one cybersecurity expert recently noted during a Campus Technology leadership summit. But how can agencies overcome these obstacles to adapt to an increasingly targeted and threatening cybersecurity landscape? Learn how your institution can safeguard against threats, overcome evolving technical demands, and more in Carahsoft’s Innovation in Education report.

Gaining Total Visibility

“We can no longer piece together a set of disparate tools to solve acute security or compliance issues. Really, the only way forward is to use a mix of integrated security technologies that deliver, first, a view into traffic and, second, a flexible enforcement model that relies on artificial intelligence and machine learning to identify attacks. The solution starts and ends with visibility. The goal is to understand how data flows through the network, cloud and endpoints so that IT can provide a consistent security view no matter how services are being used. It’s important to understand how your users are tapping those services and to surface those things that traditional tools can’t see. As one example, we have a service called Xpanse, which will take an outside-in view of the network and start to build relationships, looking at how endpoints are interacting with other endpoints that are outside of the network, contributing to the building of a map showing how the institution is connected to the rest of the world.”

Read more insights from Palo Alto Networks’ Security Strategist, Hunter Ely.

A Unifying Viewpoint for Security

“Automation of the easy security work — known threats, known responses, malware detection, cleanup — addresses both problems, and everybody wins. The campus gains better operational success. And when humans don’t have to intervene with the ordinary, they’re free to do more interesting work. They grow in their positions, because they’re not just clicking buttons all day. Automation is especially important in an era of remote status quo and zero-trust. IT has to assume that there’s a high probability of any authentication request being nefarious. And that means being able to look at data in context: Is this person at a higher risk? Is the laptop or smartphone compromised? Should we let them on the network today? Have we scanned this device in the last three days? Then let’s not allow them access to this HR data. If they get their machine scanned, then they can come back and try again. While higher ed has long been predicated on allowing open access, now that can only happen when it’s the appropriate thing to do. Users have to be classified — student, researcher, staffer — and access has to be controlled. When everything looks normal, they get unfettered access. But when their machine or account is compromised, the access should be denied. Easier said than done, right?”

Read more insights from Splunk’s Minister of Magic, Jesse Trucks.

AI and the Carrot Approach to Zero-Trust Network Access

“Some 20 years ago, I was outfitted with a BlackBerry device, and it was the first time I could get e-mail from the road. But it wasn’t the built-in keyboard that made that device so special. It was really the fact that my organization’s IT department trusted the BlackBerry security model so deeply, I could use my device to access sensitive corporate information. BlackBerry’s mission hasn’t changed. But now, that security emphasis is used to secure some 500 million endpoints — including cars — produced by various companies. That’s why higher education has rediscovered BlackBerry. The university IT organization trusts the company to keep devices secure, whether they’re owned by the institution or individual people — students, staff or faculty. And now, without having to use a college-owned device that navigates through the college-owned firewall, users can once again be liberated, just like we were two decades ago, when we first got a taste of the freedom allowed by mobility.”

Read more insights from BlackBerry’s Director of Sales, Chris Russo.

Protecting the Campus from the Outside In

“Is it any wonder threats are on the rise? As the number of system and data breaches rack up in higher education, security experts have adopted a defense-in-depth stance. Putting multiple defensive measures in place begins with a baseline security posture that wants to understand everything coming into and going out of the network, preferably in real time. The tricky part is achieving that level of visibility and response when the threats could originate from any one of the many thousands of devices accessing institutional resources. One route is deploying domain name system (DNS) security. Let’s think about DNS for a moment. It may be decades-old but it’s still heavily relied upon; without it, the entire network is shut off from the internet. Regardless of their location, endpoints require DNS to connect to any application, service or data source. And so does malware, which uses DNS at multiple stages of an attack. That’s why DNS is a marvelous transport system for malfeasance. Traditional security mechanisms don’t police it well because there’s so much of it — millions of DNS queries a day for the typical university.”

Read more insights from Infoblox’s Director and General Manager for U.S. Education, Rufus Coleman.

Uncovering the Hidden Costs of Cloud Security

“While the public cloud has been a boon for higher education on many fronts, it has also become a conundrum, especially when it comes to storage for the purposes of security and safety. As the needs add up, so does the expense. The first not-so-hidden cost is the baseline cost of data storage. As an example, think about the capacity required to sustain video recordings of people entering and exiting buildings on campus. A network of 100 cameras, each capturing 8 frames per second with a modest resolution of 720 pixels, operating continuously at just medium quality, would require 200 terabytes of capacity. On Amazon Web Services, the cost for storing 200 TB on S3 would be about $56,000 for the year. If the institution were to upgrade to newer cameras capturing 15 frames per second at 1080 pixels, generating five times as much data — a full petabyte — the expense would quintuple, to about $289,000. Microsoft Azure would be slightly under that ($262,000) and Google Cloud a bit more ($327,000). Second, there is the additional hidden cost of the traditional route those cloud storage providers follow for transactions related to the data. They’ve all predicated the value of their services on fractional pricing (a tenth of a penny for this, a couple of pennies for that) for seemingly insignificant activities, such as egress or API requests.”

Read more insights from Wasabi’s Senior Director of Product Marketing, David Boland.

Staying on Top of Cybersecurity: A Conversation with Two University CISOs

“In March 2020, I was feeling more comfortable in terms of what our border looked like and the things that we were protecting our constituents from. Then the pandemic happened and people started grabbing devices off of their desks and old laptops out of storage closets and dragging them home to put on home networks — and who knows how they were being secured, if they were being secured at all. I thought I had a fairly good plan in place and tools deployed across my infrastructure to protect us, but that was all out the window. And so, over the last year we’ve been looking at services and products we can deploy that will protect our users as well at home as we could when they were on campus. And there’s nothing like having a community of your peers to have those conversations with and to learn what they’re doing, how long it took them to get there, what bumps they ran into along the way and ultimately, how they were able to steer around those. That’s significantly beneficial to all of us, and that is a huge value of participating with Internet2 overall and through the NET+ program for specific cloud and security solutions.”

Read more insights from Tom Dugas, CISO for Duquesne University, and Rick Haugerud, CISO for the University of Nebraska-Lincoln.

Community-Powered Problem-Solving

“We facilitate the community engaging with each other to identify best practices. For example, let’s say there’s a particular challenge that a campus is trying to figure out. They may go into a community call, where campuses can ask their peers: How do you solve this problem? And then they can get immediate feedback. Or there are many ways institutions collaborate digitally, including e-mail lists, Slack channels and wikis, where they can engage with peers to identify best practices. That is all part of the NET+ program, where advisory boards and community events help to foster more optimal service offerings and benchmarking. And a program manager like myself is engaged with and supports these types of discussions. After a number of campuses have verbalized similar challenges, we’ll realize maybe there’s something there that we need to write up, to share broadly with the community, where they can look at a frequently asked questions repository and find the answers to their questions. And that’s even faster than going and asking their peers.”

Read more insights from Internet2’s Program Manager for Security and Identity, Nick Lewis.

Download the full Innovation in Education report for more insights from these cybersecurity thought leaders and additional industry research from CampusTech.

The Best of What’s New in Cybersecurity

Posted on by The Carahsoft Team

Cybersecurity reached a tipping point in 2021. One big driver is a wave of disruptive attacks — some targeting critical infrastructure and important supply chains — that has put a national spotlight on this long-simmering issue. These attacks are a wake-up call to elected officials and line-of-business leaders regarding the risk presented by growing cybercriminal activity. That call has gone all the way to the Oval Office, where the Biden Administration issued an executive order aimed at shoring up the nation’s cybersecurity through better sharing of threat information, greater adoption of Zero Trust security architectures and secure cloud services, and other measures. The COVID-19 pandemic has been another important driver, turning up the heat on modernizing security approaches and tools in state and local government. Another critical factor: There’s new money available for cybersecurity modernization. Read the latest insights from industry thought leaders in cybersecurity in Carahsoft’s Innovation in Government® report.

Achieving a Sustainable Cybersecurity Strategy

“The pandemic accelerated trends that were already in motion. Digital innovation increased to meet the need for digital interactions when face-to-face interactions weren’t possible. In addition, the massive shift to working from home impacted risk. When the pandemic hit, most organizations didn’t have all the policies, procedures and tools in place to effectively secure those environments. Another disruptor is the changing geopolitical landscape. Cyber warfare is becoming a mainstream weapon for many nation states. And then there is the explosion of fraud as a service. Attackers are taking advantage of the fact that organizations’ defenses are not ready for remote work and these other changes.”

Read more insights from Cloudera’s Field CTO, Carolyn Duby.

Intelligent, Ubiquitous Security

“Organizations need prevention and visibility on the endpoints themselves because these devices are in varying risk environments and will eventually be connected to the network, if they aren’t already. Very few sizable breaches occur without accessing or compromising an endpoint. Organizations should focus on prevention first and then visibility because the value of visibility lessens if you don’t have the resources to act on what you see. Preventing an attack early is far less expensive and time-consuming than stopping it later. Organizations need to apply a uniform Zero Trust defense strategy across all devices — mobile included — and personnel.”

Read more insights from Blackberry’s Vice President of Global Services Technical Operations, Tony Lee.

Disaster Recovery in the Age of Ransomware

“One reason cloud storage services are succeeding is because they provide high performance at a much lower cost than the large cloud providers. Many hyper-scale cloud storage providers use service tiers where organizations can store certain data “deep and cheap” for governance or compliance reasons. However, data retrieval can take hours or days and data egress fees can be very expensive. By contrast, a high-performance storage service that doesn’t use service tiers offers a better model for organizations that are fighting ransomware and need active data and a fast response time. Cloud storage services also don’t charge a data egress fee — unlike many hyper-scale cloud providers. This means disaster recovery teams can regularly practice restoring their data without paying a fee every time they do so.”

Read more insights from Wasabi’s Director of Product Marketing, Drew Schlussel.

Cybersecurity at Scale

“The first thing to understand is whether you’re going to lift and shift on-premises workloads or have everything cloud native moving forward. Understanding your cloud strategy will inform your security approach. For example, if you’re going to lift and shift a data center where applications are hosted on servers, your workload protection needs to be tuned toward server vulnerabilities, which are very different from vulnerabilities on laptops and desktops. Also, it’s not just endpoints that are vulnerable. The automation or orchestration layer can also be an attack vector. Finally, it’s important to have tools that monitor conformance to your cloud governance standards so you can avoid misconfigurations that expose your environment to attack.”

Read more insights from Trend Micro’s Vice President and General Manager for U.S. Federal Business, Chris Radosh.

Download the full Innovation in Government® report for more insights from these cybersecurity thought leaders and additional industry research from GovTech.

The Ongoing Quest for Cybersecurity

Posted on by The Carahsoft Team

Government agencies were already under pressure to modernize their cybersecurity strategies before the pandemic hit, and as workplaces closed and government employees struggled to access data and systems from makeshift home offices, the cybersecurity risks grew. The use of virtual private networks in the U.S. increased to match the early spike in COVID-19 cases, rising 124% in the two weeks from March 8 to March 22, 2020, according to Statista. Around the same time, the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert titled “Enterprise VPN Security,” which offered both warnings and guidance on how to handle the surge in usage. With so many employees logging in remotely, agencies found that they had to shift their focus from securing a well-defined perimeter to securing the data that fuels government operations. In a recent survey of FCW readers, protecting data topped the list of cybersecurity priorities, with 75% of respondents citing it. In response to such concerns, CISA released its Ransomware Guide in September 2020. And in May, President Joe Biden mandated that agencies adopt zero trust in his Executive Order on Improving the Nation’s Cybersecurity, and the National Security Agency released a paper a few months ahead of that mandate titled “Embracing a Zero Trust Security Model.” Read the latest insights from industry thought leaders in Carahsoft’s Innovation in Government^® report on cybersecurity.

The Future of Cybersecurity is Autonomous

“Analysts have too much atomic data and not enough context about that data. When they don’t have the full picture, they can’t take appropriate action. Re-creating each attack by hand takes painstaking care. And though analysts often relish this challenge, there’s simply not the time to do so for every presented case. Forward-thinking organizations are using artificial intelligence/machine learning (AI/ML) capabilities to fortify user endpoints and server workloads across an array of operating systems. These automations are designed to monitor the growing number of attack vectors in real time and present the full context of an attack in an easy-to-understand view that’s modeled after a kill chain.”

Read more insights from SentinelOne’s COO, Nick Warner.

Tailoring Zero Trust to Individual Users

“Zero trust is an important construct for helping agencies protect their infrastructure in today’s cybersecurity landscape. It focuses on accrediting individuals and their access to government resources. Agencies should make those decisions about access based on a comprehensive understanding of users. Security policies that treat all users as equally risky can be restrictive. Such policies set the bar high and hamper employees’ ability to work, or they set the bar low, which defeats the purpose of having security. Instead, agencies should evaluate users on an individual basis by taking the time to understand what employees do and how they do it — what’s normal behavior and what’s not. Then they can assess the risk of an individual based on that context.”

Read more insights from Forcepoint’s President of Global Governments and Critical Infrastructure, Sean Berg.

Modernizing Security for a Mobile Workforce

“Securing data and apps begins with positively identifying the user. In government, agencies have used multifactor authentication and all kinds of certificates, but those are simple pass/fail security checks. Once users are allowed to cross the security barrier, they often have wide-ranging access to government resources. This means adversaries and malicious (or careless) insiders passing the security checks receive free rein as well. Government needs to move to a continuous authentication model, which leads to better security and a better user experience. It involves seamlessly authenticating users every step of the way — when they touch the keyboard or scroll through an app on a screen. That activity, down to the microscopic vibrations in a person’s fingertip, can be sensed and understood so that IT administrators can answer the question: Is this really the authenticated user, or is it somebody else?”

Read more insights from BlackBerry’s Chief Evangelist, Brian Robison.

The Dangers that Lurk in Mobile Apps

“Government employees are increasingly reliant on mobile applications to do their jobs. But without formal monitoring programs in place, agencies might be unaware of the risks inherent in commercial and government-built apps. As a result, few agencies are investing resources and time to address a serious problem. The average mobile device has 60 to 80 apps, representing a huge potential for vulnerabilities at agencies whose employees are using those devices for work. Thousands of apps could be tracking employees or intercepting data. NowSecure founder Andrew Hoog has said mobile apps are the ultimate surveillance tool, given the mix of personal and mission activities in one space.”

Read more insights from NowSecure’s Chief Mobility Officer, Brian Reed.

Why Data is a Critical Cybersecurity Tool

“Once agencies have gathered their data in a scalable, flexible platform, they can apply artificial intelligence to derive insights from the data. AI speeds analysis and is particularly effective when agencies move from signature-based to behavior-based threat detection. A signature-based approach is good for detecting threats we already know about, but a behavior-based AI approach can adapt to new threats by looking for anomalies such as changes in the behavior of a server or endpoint device. AI also helps with investigations by reconstructing the sequence of events that happened during an intrusion, which fuels agencies’ ability to prevent future attacks. With AI, agencies can start to apply more sophisticated algorithms in their hunt for vulnerabilities and cyber threats.”

Read more insights from Cloudera’s Principal Solutions Engineer and Cybersecurity SME Lead, Carolyn Duby.

Zero Trust Data Management Foils Ransomware Attacks

“Agencies must ensure recoverability because none of these protections matter if they can’t recover data and systems that run their critical missions and operations. Agencies need to gather and protect data at the edges of their networks, in their data centers and across different clouds. And regardless of where agencies decide to store that data, they need to be able to access it instantly. Recoverability service-level agreements of minutes and hours are possible and delivered today across the whole of government and the Defense Department. Gone are the days of weeks and months to get back online.”

Read more insights from Rubrik’s Public-Sector CTO, Jeffrey Phelan.

Reclaiming Control over Complex IT Environments

“When employees were sitting in a government office behind a firewall, IT administrators had a clearly defined perimeter to protect. Now IT administrators are still focused on protecting the agency’s mission and assets, but the responsibility has become more difficult because they’ve lost some visibility and control over the infrastructure. In response, many organizations are moving toward strategies based on zero trust, which requires validating users and devices before they connect to government systems, or least privilege, which involves only giving employees access to the resources and applications they need to perform their jobs. Zero trust and least privilege require continuous monitoring and a risk-based approach to adding or removing authorizations.”

Read more insights from SolarWind’s Group Vice President of Product, Brandon Shopp.

The Role of Authentication in Data Protection

“Users who need to access low-risk applications and data — for example, publicly available product information — can use an authentication method such as one-time password tokens. But if that same user wants to access higher-value data such as corporate finance records, the required level of authentication should increase, perhaps requiring public-key infrastructure (PKI) authentication with a smartcard. The key is to manage those activities via one pane of glass or one platform that supports the entire risk-based and continuous authentication process. In the past, we’ve been able to base decisions on where users are located — for example, whether they’re accessing data from within the network or remotely via VPN — but that is no longer enough. New technology tools enable agencies to gain a deeper understanding of users’ online behavior so they can make more informed decisions about authentication.”

Read more insights from Thales TCT’s Vice President of Product Management, Bill Becker.

Verification and Validation to Enhance Zero Trust

“Networking teams rely on standard configurations to maintain the security policy. These standard configurations dictate connectivity and traffic flows to ensure users can access appropriate resources while preventing unauthorized access. The idea of a standard configuration seems simple, but maintaining it is extremely difficult. Validating configurations is clearly mission critical, but monitoring and validating network behavior are even more telling and help ensure that policies are not inadvertently being circumvented and that there is no unintended connectivity.”

Read more insights from Forward Networks’s Technical Solutions Architect, Kevin Kuhls.

Extending Zero Trust Down to the File Level

“A software-defined perimeter integrates proven, standards-based security tools to create the ideal foundation for zero trust. When used together, those two approaches give agencies the granularity to customize their security protocols. For example, the IT team could allow USB mice but not USB thumb drives that can store data, and they could block potentially unwanted applications that anti-malware engines might not identify as malicious, such as bitcoin-mining or file-sharing apps. Zero trust is a mindset rather than a specific group of tools. The National Institute of Standards and Technology’s Special Publication 800-207 on zero trust architecture advocates taking a holistic approach to authenticating devices and users and extending that attitude to agency assets, services and workflows.”

Read more insights from OPSWAT’s Senior Director of Government Sales, Michael Hylton.

Download the full Innovation in Government® report for more insights from these government cybersecurity leaders and additional industry research from FCW.

Raising Agencies’ Cyber Intelligence

Posted on by The Carahsoft Team

Nationwide, many government agencies are realizing that traditional approaches to cybersecurity are no longer enough to protect against increasingly sophisticated adversaries and navigate a complex threat landscape. For example, cybersecurity strategies have historically focused on the perimeter, ignoring the risk of internal threats and failing to account for mobile devices or teleworking employees. In an era of tightening budgets and rising citizen expectations, government must adapt to these modern realities. Cyber intelligence uses behavior analytics, network visibility, and operational and threat intelligence to make agencies smarter about today’s threats. If your agency is in need of a forward-looking cybersecurity approach, get up to date with “Raising Agencies’ Cyber Intelligence,” a guide created by GovLoop and Carahsoft featuring insights from the following technology and government cyber intelligence thought leaders.

Storytelling with Intelligence-Led Security

“Too often, agency leaders and cybersecurity analysts seem like they’re speaking separate languages. With both sides communicating about cyberthreats differently, getting everyone on the same page is one of contemporary government’s greatest challenges. The wider the gulf between an agency’s teams, the more vulnerable it is to external danger. Today’s security landscape contains dangers everywhere, and cyberthreats won’t wait for agency workforces to unite against them. Agencies that don’t speak the same language as their employees and employees that don’t speak the same language as their agency leaders will find themselves constantly fighting cybersecurity fires.”

Read more insights from Recorded Future’s Threat Intelligence Analyst, Allan Liska.

Leveraging Zero Trust Against Cyberattacks

“Agencies aren’t looking just at the “north-south” of traffic moving inside their network perimeters for threats. Lateral cyberattacks occur when perpetrators breach agencies’ defenses and then move freely “sideways” or “east-west” on their networks. The modus-operandi of cybercriminals today is to seek a weakly defended element, and then access sensitive data by moving laterally to avoid stronger safeguards. This protection against lateral movement is what zero trust cybersecurity is all about. By automatically distrusting everything on and off their networks, agencies can enhance their IT security.”

Read more insights from Trend Micro’s Vice President of Cybersecurity, Greg Young.

Threat Intelligence: The Context Agencies Crave

“Basic cybersecurity knowledge — such as which attacks are most common — won’t always keep agencies’ data safe. For scores of agencies, today’s threat landscape can change too fast for their workforces. Fortunately, threat intelligence can prepare agencies for cutting-edge dangers. Threat intelligence adds the context agencies need by focusing on the latest threats in realtime. […] The worst cyber attacks are the ones agencies never see coming. But with quality threat intelligence, agencies can stay alert to where cyberthreats might strike next.”

Read more insights from Fire Eye’s Principal Analyst, Luke McNamara.

Pairing Man and Machine on Zero Trust

“Since the COVID-19 pandemic began, the number of endpoints to defend has exploded as government employees started working remotely. These endpoints include devices such as laptops, smartphones and tablets, and they are leaving agencies more vulnerable than before. Going forward, the more endpoints agencies have, the more targets they will present to cyberthreats. […] Zero trust cybersecurity addresses de-perimeterization, or the gradual erosion of network boundaries. With zero trust, users must be capable of securely accessing data from anywhere no matter where it resides.”

Read more insights from Blackberry Limited’s Vice President of Global Sales Engineering, Rich Thompson.

Prioritizing Cyber Intelligence at the Defense Logistics Agency

“One of the things I would tell you is more of a concern than it has been in the past is the large number of endpoints that are seated on our networks today, especially with mass telework becoming the norm over the last few months. Identifying and confirming anomalies and positive, adverse actions has become more difficult. It has amped up our attention on automation, machine learning and robotic process automation and bringing that into the fold to a greater degree across the cybersecurity spectrum. It is almost a must now because of the massive amounts of data to sift through to get to what you’re seeking.”

Read more insights from DLA’s CIO, George Duchak, and Director of Cybersecurity, Linus Baker.

Minnesota Chief Information Security Officer Explains Zero Trust Cybersecurity

“Unlike other types of attacks where weapons require certain tactical research, there is a low effort in the cyberthreat domain. The global threat landscape will continue to have new entrants as actors build strengths and develop talent. There’s this model of a cyber kill chain. It talks about how attackers move from discovery all the way to mission completion, whatever the mission might be. If we build layers of defenses that look at that cyber kill chain, can we identify the mission actions through that cycle before the mission completes?”

Read more insights from Minnesota Chief Information Security Officer (CISO) and Minnesota IT Services’ (MNIT) Assistant Commissioner, Rohit Tandon.

Understanding DoD’s Cyber Hotline

“Picture the Vulnerability Disclosure Program (VDP) as the hotline for reporting DoD’s cybersecurity shortcomings. Nestled in DoD’s Cyber Crime Center (DC3), the program makes the philosophy of “see something, say something” digital. At any time, ethical hackers can alert DoD to issues ranging from insecure networks to noncompliance with cybersecurity standards such as FISMA.”

Read more insights from DoD’s Director of the Vulnerability Disclosure Program, Kris Johnson.

Download the full GovLoop Guide for more insights from these cyber intelligence thought leaders and additional government interviews, historical perspectives and industry research on zero trust, the government threat landscape and the latest developments from government programs like CDM.

CIO Perspectives: A New Vision for the Government Workplace

Posted on by The Carahsoft Team

In the early days of the COVID-19 crisis, most government chief information officers (CIOs) focused on fundamental questions related to transitioning to remote work and virtual environments while still maintaining services and meeting citizens’ needs. Over time, however, they realized that in responding to the crisis, agencies were crafting a new model for agency operations. In many cases, it was indeed possible to carry out the business of agencies in a virtual environment. Employees could stay engaged, work processes often were streamlined and digital services proved their worth. In part, the goal of this new model is to improve operational resiliency for the next crisis, but the new model also is geared toward transformation — helping agencies adopt more efficient and effective processes that deliver better services. Read more from CIOs within both Federal and state government on the lessons learned from the transition to telework and their goals for the future in “CIO Perspectives: A New Vision for the Government Workplace,” a guide created by GovLoop and Carahsoft featuring insights from the following technology leaders.

Creating a Roadmap to Resilience

“Resiliency means having the ability to rapidly resume delivery of services after a disruptive event and to continue operating in that new environment as long as needed. True resiliency goes beyond simply creating redundant capabilities that can ensure the availability of data and systems. It’s about taking a holistic approach to the people, processes, and systems involved in delivering services and ensuring that all three aspects are addressed as part of a continuity strategy. The ServiceNow platform is designed to help agencies create digital workflows that connect people, processes and systems. The platform is supported by a single data model and common application logic that makes it easy to automate processes and update those processes when requirements change.”

Read more insights from ServiceNow’s Chief Technology Officer of Global Government, Bob Osborn.

The Virtual Environment’s Key Attributes

“For many government employees, one of the biggest challenges of the remote work situation has been to continue effectively delivering on their mission critical operations. Virtual environments have become mainstream and indispensable for a variety of use cases, whether it’s large virtual gatherings, training sessions or meetings. It has been a paradigm shift, and if agencies can get it right, virtual environments could play a bigger role than ever even after the current crisis, reducing the need for travel, costs of large physical events, and providing more flexibility and reach… Whatever the situation, remote work has demonstrated that a virtual environment is not just a fallback plan, but a valuable option for agencies even in normal working conditions.”

Read more insights from Adobe Connect’s Senior Enablement Manager, Alistair Lee, and Product Evangelist, Peter Ryce.

Seeing Clearly With Network Visibility

“Government IT networks are increasingly difficult to manage. Citizens want digital services that are equal to the private sector’s. Cybersecurity risks, meanwhile, are multiplying daily. And the volume of data is growing faster than ever. The COVID-19 pandemic complicated this situation further for federal agencies. Whether they’re civilian or defense, these networks have been under unprecedented strain as most government employees have been working from home. Network visibility can help agencies see all these challenges clearly and solve them. Using the right tools, agencies can continuously monitor their networks’ performances and security.”

Read more insights from Gigamon’s Vice President of Public Sector, Dennis Reiley.

The 5 Elements of Government Digital Transformation

“Advanced operations through competencies such as Site Reliability Engineering (SRE) is about looking at transformation from an operational perspective. How well does a new digital service meet enterprise requirements for performance, reliability and security? …organizations should establish an enterprise-level minimum viable product (MVP) that lays out key requirements that all products must meet. In advising agencies going through an open transformation, Red Hat is not pushing a solution. Instead, these five elements are designed to help agencies think about the key decision areas they must address.”

Read more insights from Red Hat’s Digital Transformations Architect (DoD/IC), Dmitry Didovicher.

Unified Endpoint Security: Bringing Order to Chaos

“In cybersecurity, organizations create chaos with the best of intentions. Their goal is to make incremental gains in security by implementing new solutions that make up for the deficits of older ones and adding new controls to compensate for the limits of existing ones. To make matters worse, the IT environment itself has grown more complex, creating new attack vectors that malicious actors can exploit. Clearly, agencies need to reduce the chaos and improve security. But they also need to ensure their cyber strategy does not hinder employee productivity. Those competing needs were more apparent than ever when gubernatorial mandates in response to the COVID-19 crisis required thousands of employees to begin working from home, some using their own devices. How could agencies protect applications and data without creating new obstacles for employees? “

Read more insights from Blackberry’s Senior Vice President and Chief Information Security Officer, John McClurg.

Identity Access Management in the Telework Era

“Nationwide, agencies have embraced telework during the COVID-19 pandemic. While most agencies have rapidly transitioned to remote work, it hasn’t been without challenges. Many agencies couldn’t provide remote access to systems except email when the crisis first hit and as a result, workers couldn’t access many of the systems they use daily. At the same time, threat actors haven’t been sitting still, and attacks such as phishing and spear phishing are on the rise. Now, traditional network-oriented security isn’t sufficient with users accessing resources from more locations and devices than before. That is why identity and access management (IAM) is critical to helping agencies navigate this new normal. IAM covers the policies and tools ensuring the correct people have the appropriate access to organizational resources. “

Read more insights from Okta’s Senior Marketing Manager, Kelsey Nelson.

Election Security Is About More Than Voting Machines

“Conversations around election cybersecurity have gone mainstream. Much of those discussions focus largely on voting machines and known security flaws that hackers can use to compromise the technology. But that’s only a fraction of the larger issue…Today, as a pandemic rages across the globe, government agencies are exploring alternatives to in-person voting to promote social distancing. Even still, cybersecurity must remain an integral part of the conversation. “

Read more insights from Rapid7’s Research Director, Tod Beardsley.

How to Meet the IT Management Challenges of Remote Work

“Throughout the COVID-19 crisis, government agencies have learned two basic lessons about remote work. First, the experience has diminished doubts about whether employees could work effectively and efficiently outside the office. Second, it’s made IT leaders aware they need a better strategy for managing this remote environment… More than anything, the experience of remote work has taught IT managers to think in new ways about the enterprise.”

Read more insights from SolarWind’s Vice President of Product Strategy, Brandon Shopp.

Download the full GovLoop Guide for more insights from these telework and cybersecurity thought leaders and additional interviews and perspectives from government CIOs at FDIC, GSA, NRC, NSF, and the states of Colorado and Delaware.