Building a DevSecOps Culture

Posted on by Rich Savage

As software becomes more sophisticated, it plays an increasingly important role in all aspects of government operations. However, given the complexity and intertwined nature of modern software, any vulnerability could have wide-ranging consequences, which makes security of vital importance. The federal government has taken notice. A number of recent policy directives address issues related to the software supply chain, and key agencies are leading a governmentwide effort to promote secure software development, including the Executive Order on Transforming Federal Customer Experience and Service Delivery to Rebuild Trust and the Executive Order on Improving the Nation’s Cybersecurity. Learn how you can implement DevSecOps to support your journey to secure, innovative software in Carahsoft’s Innovation in Government® report.

The Mindset Shift that Enables DevSecOps

“In an ideal world, technology and processes support team members’ ability to deliver on their particular talents. Before agencies implement DevSecOps methodologies, they should identify where their processes are getting bottlenecked and forcing people to either work around them or fundamentally change their behavior. Instead, we want to make it easy for employees to do the right thing. The goal is to enable people to focus on what they do best — regardless of where they operate in the stack or the tools they are using — so that agencies can build and deploy secure, modern apps.”

Read more insights from Alex Barbato, Public Sector Solutions Engineer at VMware.

How Generative AI Improves Software Security

“Generative AI tools are becoming increasingly prevalent, providing interactive experiences that captivate the public’s imagination. These tools are accessible to anyone, offering a unique opportunity to engage and explore the creative possibilities enabled by AI technology. The technology doesn’t just train a model to recognize patterns. It can create things that are easy to understand: images, text, even videos. Sometimes the results are hilariously wrong, but other times the results are quite impressive, such as clear, concise answers to complex questions. Generative pre-trained transformer (GPT) technology, such as ChatGPT, has opened the doors for everyone to be an evaluator because the output is accessible and easy to critique.”

Read more insights from Robert Larkin, Senior Solutions Architect at Veracode.

Open Source is at the Heart of Software Innovation

“Embedding security into applications from the start is essential for streamlining and strengthening the entire development life cycle. Securing the software supply chain is a related effort that is of vast importance to government operations. Beyond securing individual applications, the ultimate goal is to build security into the pipeline itself. At each step and every handoff, we must be able to verify who has touched the software and who did what to ensure that the end result is what we intended to build and that nothing malicious has been injected along the way.”

Read more insights from Chris Mays, Staff Specialist Solutions Architect at Red Hat.

DevSecOps Needs Tool Diversity and Collaboration

“As DevSecOps methodologies and software factories grow in prevalence, agencies are recognizing that software development is a team sport — inside the agency, across departments and with external stakeholders. It touches many different teams, but getting everyone on the same page with tooling can be difficult. Different teams prefer different tools, and that makes collaboration hard. Modern software development brings security practices forward in the timeline while reducing duplication of efforts and improving real-time accountability. Success hinges on removing blockers, creating visibility and making sure collaboration is happening at every stage. In addition, encouraging input from different areas of the organization from the beginning and throughout development is vital for innovation.”

Read more insights from Ben Straub, Head of Public Sector at Atlassian.

Observability Speeds Zero Trust and Application Security

“In response to increasing cyberthreats, the government is speeding up the move to zero trust. This security model assumes that every user, request, application and non-human entity is not to be trusted until its identity can be verified. Zero trust principles require a layered defense that is more effective when rooted in observability. To develop an architecture that validates and revalidates every entity on the network, it is necessary to know what those entities are, how they’re communicating and how they typically behave so we can recognize deviations. Zero trust and observability technologies work together to create a more secure and resilient network environment by assuming that all requests for access are untrusted and continuously monitoring the network to detect and respond to potential threats.”

Read more insights from Willie Hicks, Public Sector Chief Technologist at Dynatrace.

The Role of a Service Mesh in Zero Trust Success

“For large companies and government agencies, it’s safe to assume that a committed attacker is already inside their networks. Executive Order 14028 mandates that every federal agency develop a Zero Trust architecture because it is the most effective approach to mitigating what attackers can do once they’ve made their way inside. What does Zero Trust look like at runtime? One of the key considerations is identity-based segmentation, which involves conducting five policy checks for every request in the system: encrypted connection between service endpoints, service authentication, service-to-service authorization, end user authentication, and end user-to-resource authorization.”

Read more insights from Zack Butcher, Founding Engineer at Tetrate and co-author of the NIST SP 800-200 series and SP 800-207A.

AI and the Journey to Secure Software Development

“By automating and optimizing DevSecOps workflows, we can still shift security left while relieving developers from the burden of some complex remediation. It begins with a workflow that leverages fully automated security scanning to rapidly identify vulnerabilities as well as providing suggested remediation for vulnerabilities and on-demand remediation training to educate developers on what they are getting into. The rapid evolution of artificial intelligence is making new advances possible. The opportunities go well beyond AI-assisted code creation. AI features are being expanded across the entire software development life cycle. When it comes to security, having AI assist by making code functionality clear or explaining a vulnerability in detail reduces the time required to remediate risk.”

Read more insights from Joel Krooswyk, Federal CTO at GitLab.

Scaling App Development While Meeting Security Standards

“The dream for any software development team is constant, stable releases. The faster teams get the work they’ve created into production, the faster the agency can derive value from that work. When app development is stymied by cumbersome security reviews and stability testing and by the need to wait for a deployment window, innovation is stifled and the return on investment is delayed. If agencies want to have efficient, value-driving software development teams, those teams must be able to move with agility. A trustworthy, scalable DevOps pipeline that brings together testing and security in a seamless way allows teams to push out new apps and improvements quickly so government employees and citizens can have a seamless digital experience and the most up-to-date tools and information.”

Read more insights from Kyle Tobener, Head of Security and IT at Copado.

Join us in-person for our must-attend DevSecOps Conference—an exciting day of exhibits, speaking sessions, and networking events. We look forward to showcasing new DevSecOps updates from our supporting panels featuring government, systems integrators, and industry thought leaders.

Download the full Innovation in Government® report for more insights from DevSecOps thought leaders and additional industry research from FCW.

Ransomware Protection for Kubernetes Data in the Public Sector

Posted on by Gaurav Rishi

Kubernetes is a powerful platform for deploying and managing containerized applications in the cloud. It offers many benefits such as scalability, portability, resilience and automation. However, Kubernetes also poses some challenges when it comes to data protection and security, especially in the public sector where sensitive data and compliance regulations are involved. That’s why we are excited to continue our strategic partnership with Carahsoft Technology Corp., the leading government IT solutions provider, to deliver Kasten K10 by Veeam, the market-leading Kubernetes data protection solution, to public sector customers across the U.S.

In this blog post, we will explore some of the common issues that public sector organizations face when using Kubernetes, and how Kasten K10 by Veeam can help them overcome these challenges with a simple, secure and scalable solution for Kubernetes data protection.

The challenges of Kubernetes Data Protection in the Public Sector

One of the main challenges of Kubernetes data protection in the public sector is the complexity and diversity of the Kubernetes environment. Kubernetes clusters can span multiple clouds, regions and zones, and contain hundreds or thousands of applications and microservices. Each application may have its own data sources, dependencies and configurations, which need to be backed up and restored consistently and reliably.

Veeam Ransomware Protection Blog Embedded Image 2023

Another challenge is the security and compliance of the Kubernetes data. Public sector organizations often deal with sensitive data such as personal information, health records, financial transactions or national security secrets. These data need to be protected from unauthorized access, modification or deletion, as well as from external threats such as ransomware attacks. Moreover, public sector organizations need to comply with various regulations and operate in secure environments, which requires cluster deployments in compliant hybrid environments spanning examples like AWS GovCloud and Red Hat OpenShift.

A third challenge is the scalability and performance of the Kubernetes data protection solution. As Kubernetes clusters grow in size and complexity, so does the amount of data that needs to be backed up and restored. Public sector organizations need a solution that can handle large volumes of data without compromising the availability or performance of the Kubernetes applications. They also need a solution that can scale up or down as needed, without requiring manual intervention or complex configuration changes.

The Solution: Kasten K10 by Veeam

Kasten K10 by Veeam is a purpose-built solution for Kubernetes data protection that addresses all these challenges and more. Kasten K10 is designed to simplify and automate the backup and recovery of Kubernetes applications and their data across any environment. It offers the following features and benefits for public sector organizations:

Application-centric approach: Kasten K10 treats each Kubernetes application as a unit of backup and recovery, rather than individual containers or volumes. This ensures that the application state and dependencies are preserved across backups and restores, regardless of where they are running or how they are configured.
Policy-driven automation: Kasten K10 allows public sector organizations to define backup policies based on application metadata such as labels, annotations, namespaces or clusters. These policies can specify the frequency, retention, location, encryption and compression of the backups, as well as any custom actions or hooks that need to be executed before or after the backup. Kasten K10 then automatically applies these policies to the matching applications, eliminating the need for manual backups or scripts.
Secure and compliant data protection: Kasten K10 encrypts all backup data at rest and in transit using AES-256 encryption keys that are stored in a secure key management system. Kasten K10 also supports role-based access control (RBAC) and audit logging to ensure that only authorized users can access or modify the backup data. Additionally, Kasten K10 provides ransomware protection by creating immutable backups that cannot be overwritten or deleted by malicious actors.
Scalable and performant architecture: Kasten K10 leverages a distributed architecture that scales with the Kubernetes cluster. It uses parallelism and deduplication to optimize the backup, restore performance and reduce the storage footprint. It also supports incremental backups and restores to minimize the network bandwidth and application downtime.
Application portability: Kasten K10 enables public sector organizations to ensure application portability across diverse Kubernetes environments by using Transform Sets. Transform Sets are a set of rules that can modify the application configuration during backup or restore, such as changing namespaces, labels, annotations, storage classes, or secrets. This allows public sector organizations to migrate their applications from one cluster to another, or from one cloud to another, without breaking their functionality or security.

Next Steps

We hope this blog post provided valuable insights into how Kasten K10 by Veeam can help you protect your Kubernetes data in the public sector. If you want to learn more, here are some next steps you can take:

Watch this video to see Kasten K10 in action and learn how it can simplify and automate your Kubernetes data protection workflows: https://youtu.be/gu3J6ZeWwK8

Try the full-featured and FREE edition of Kasten K10 today with this super-quick installation in less than 10 minutes: https://www.kasten.io/free-kubernetes

Don’t miss this opportunity to take your Kubernetes data protection to the next level with Kasten K10 by Veeam and Carahsoft. We look forward to hearing from you soon! Download our full Gorilla Guide to Securing Cloud Native Applications on Kubernetes.

Empowering Public Sector Technical Teams With Generative AI in a Secure Collaboration Platform

Posted on by Ian Tien

Recent advances in generative artificial intelligence (AI) – with its seemingly limitless potential use cases – have captured the public imagination. And they’re just as compelling to government agencies and the military. Organizations across the public and private sectors are racing to identify the most effective applications of the technology and to implement robust and secure solutions enabled by generative AI.

For instance, generative AI can be a powerful assistant to technical and operational teams such as those involved in application development and incident response. The technology can help teams gain real-time insights, bring to light solutions to unexpected problems, and help make fast, data-driven decisions.

It’s with those advantages in mind that Mattermost partnered with Ask Sage to integrate the Ask Sage GPT solution with the Mattermost secure collaboration platform. The result is secure, AI-enhanced collaboration for technical teams in the U.S. public sector.

Real-time Insights, Natural-language Format

Mattermost is a secure, workflow-centric collaboration platform for technical and operational teams that need to meet nation-state-level security and trust requirements. Available self-hosted or in the cloud, Mattermost integrates team messaging, audio and screen share, technical tools, workflow automation, and project management in an open-source solution.

Mattermost Generative AI Blog Embedded Image 2023

Ask Sage is a GPT-powered platform provider that specializes in enabling secure access to Generative AI capabilities for both government and commercial teams. With a wide range of use cases, including summarization, coding, code review, code improvement, RFP writing, responding and evaluation, and report writing, Ask Sage is built on cutting-edge AI technologies such as Azure OpenAI GPT, Cohere, Google Bard, and various open-source LLMs. The solution can ingest custom datasets, tap into APIs, and connect to data lakes for real-time data and insights in a natural-language format.

Ask Sage can quickly and automatically process large amounts of structured and unstructured data – including government-related data such as laws, Federal Acquisition Regulation (FAR), Defense Federal Acquisition Regulation Supplement (DFARS), DoD Controlled Unclassified Information (CUI), and DoD policy and governance content. Outputs include summaries, translations, sentiment analysis, deep insights, and coding.

Integration of Ask Sage with Mattermost provides technical teams with secure, real-time access to generative AI to enhance collaboration, operational productivity, and decision quality. Government and contractor teams can now securely leverage the power of OpenAI and collaborate within a single, seamless interface.

Real-time Insights, Natural-language Format

With this strategic integration, Mattermost equips technical teams to leverage generative AI to accelerate processes, increase output, and improve outcomes. It’s ideal for government teams that write code, manage RFPs, analyze large data sets, or develop and translate intelligence reports.

Ask Sage offers rapid data analysis and summarization to help teams gain new insights as circumstances evolve. Team members spend less time and effort on manual research and analysis, giving them more time to focus on higher-priority decision-making and strategic tasks.

Users can improve the accuracy and depth of Ask Sage results by uploading relevant data –which is labeled by classification level, encrypted, and separated from the OpenAI models. Once uploaded, the data can be accessed only by authorized users through granular access controls within Mattermost.

Collaboration Purpose-built for Public Sector

Mattermost is well-suited to technical public sector teams, because it’s available as an on-prem, self-hosted deployment. That means teams can collaborate securely with lower risk of compromise. It’s also an open-source solution, so organizations can tailor security settings to protect information at impact levels up to IL6 for DoD Secret data. That’s protection that general-purpose, cloud-based productivity and instant-message tools can’t match.

The platform allows teams to create as many topic- or project-specific communication channels as they need. These channels allow users to centralize conversations, data, and tools – including Ask Sage – in the right context. That keeps team members focused and productive, without the need to continually context-switch.

Another useful Mattermost feature is built-in, customizable playbooks – essentially digital checklists – that help team members consistently take the right actions at the right times. Mattermost playbooks can now include generative AI to further automate and accelerate project workflows and incident response.

Leveraging Mattermost’s secure collaboration platform combined with Ask Sage’s generative AI capabilities can revolutionize the way government teams work together, manage technical projects, and respond to mission-critical situations. As interest in OpenAI GPT and similar platforms grows, this strategic integration is a gamechanger in enabling U.S. government and military organizations to securely benefit from generative AI.

Speak with a member of our team today and learn more about Mattermost at www.mattermost.com.

Returning to the Heart of Customer Experience: A Government for the People

Posted on by Tiffany Goddard

At Carahsoft’s annual Government Customer Experience and Engagement Summit hosted in June, experts from industry and Federal, State, and Local Government came together to discuss stewardship, innovation and paths forward in customer experience (CX). At the one-day event, the thought-provoking sessions examined trends regarding two main themes in the CX journey: culture and technology. The culture track explored ideas for effective leadership, understanding and supporting employees and the importance of diversity, equity and inclusion. The technology track considered goals within IT modernization, artificial intelligence and automation and the digitization of services. This blog series highlights lessons learned from the 2023 Summit and unpacks strategies for achieving excellence in Government CX and engagement.

The Big Picture of Customer Experience

During the opening keynote session, President of GovExec360, Troy Schneider, held a discussion with Barbara Morton, Deputy Chief Veterans Experience Officer, Veterans Experience Office (VEO) at the Department of Veterans Affairs (VA), emphasizing the importance of accessibility and accountability in service delivery. Morton said that purpose is at the heart of customer experiences. Whether they are in the government or supporting from the outside, public servants must consider the barriers along with the opportunities that foster trust, serve the greater common purpose and create excellence in CX. In the Public Sector, CX establishes how constituents engage with civic services. By transforming CX, the public sector can build and progress toward greater trust with those it serves.

Great CX starts with an organizational understanding that building and sustaining trust matters. With that agreement in mind, organizations can better support the mission of delivering efficient CX by learning and adapting to the needs of people they are serving. Agencies should provide visibility to customers on the timeliness and process of their requests, as well as deliver on their promises to foster trust and assurance of reliability. Using human-centered design throughout all stages of CX is also essential for understanding the human perspective and anticipating customer needs. As data is collected throughout the human-centric design approach, organizations gain actionable insights that help them create the best tangible solutions for customer challenges.

Use Case: The Department of Veterans Affairs

Government agencies and organizations must focus on traditional operational measures, and the VA ensures it takes another step forward to evaluate experience-based metrics and treat these insights as co-equal when it comes to agency performance. Morton said that action drivers like executive orders and Office of Management and Budget’s (OMB) efforts are significant authorities in the transformation of Government CX to continuously progress toward access equitability and efficiency. With their guidance, agencies must agree on the top priorities for service delivery and then incorporate the human-centered design aspect. For example, the VA examines women and tribal veteran’s experiences to ensure it can translate those insights into meaningful and applicable products so those groups feel better understood when interacting with the VA. Additionally, in a digitally driven world, organizations must provide experiences with easy-to-navigate accessibility. Each agency should have a clear homepage or “digital front door” that customers know how and when to access.

Lasting Progress for Lasting Change

In the government, CX can make a measurable difference in the lives of individuals or families going through significant life changes, such as a natural disaster or medical crises as an active or retired veteran. Open source technology that intersects with the government at Federal, State and Local levels can achieve economies of scope and scale, and the improvement of financial savings proportionate to goods produced. The addition of effective CX technology allows government agencies to provide more assistance to more people, having a profound impact in their lives.

Check back soon to read the rest of Carahsoft’s insights from CX industry thought leaders at the summit.

To learn more about the latest in the CX landscape and how Carahsoft’s industry-leading partners can support your Customer Experience initiatives, please visit our resource hub to access all on-demand recordings and information from the 2023 Government Customer Experience and Engagement Summit.

Partnerships for Public Sector Solutions

Posted on by Mike McCalip

Systems integrators have evolved to simplify and streamline the process of deploying complex solutions to complex agency challenges. SIs have years of experience working with agencies on the kinds of systems that have many moving parts. Therefore, they have a clear understanding of agency missions and know how to navigate the government’s procurement process. However, SIs don’t work alone. They thrive by partnering with companies that have transformative new approaches for addressing the government’s needs, such as providing innovative digital services, supporting a hybrid workforce and protecting government networks from cyberthreats. In a recent report, research firm Quadintel states that the global systems integration market was valued at $327 billion in 2021 “and is anticipated to grow with a healthy growth rate of more than 13% over the forecast period 2022-2028.” SIs are well-suited to helping agencies make that shift in thinking. Learn how Sis can help your agency thrive by partnering with innovative companies in Carahsoft’s Innovation in Government® report.

The Power of Embracing a Partner Mindset

“Success for integrators and their partners is delivering secure solutions that provide meaningful and impactful mission outcomes. Leidos invests heavily in testing and building relevant solutions for public-sector customers to ensure that innovative technologies are cost-effective, resilient, compliant with government requirements and best positioned to solve mission problems. Investing in a continuous innovation cycle is critical. Leidos and Red Hat recognize that we are in the business of continuous modernization. When Red Hat and other key partners offer innovative new solutions, our partnerships enable us to move fast in testing and proving that the technology works and can scale to meet the government’s needs. Leidos leverages innovative technology to drive great mission outcomes in our Aviation Security Product business unit (Security Enterprise Solutions). By using cloud-native AI/ML modeling solutions, Leidos had been able to achieve significant performance gains in our process for developing algorithms for security detection products, ultimately improving travelers’ experiences at airports.”

Read more insights from Peter O’Donoghue, CTO of the Civil Group at Leidos, and Adam Clater, chief architect of the North America Public Sector at Red Hat.

A Collaboration That Far Exceeds the Sum of its Parts

“In 2020 KMPG and ServiceNow recognized that a large and newly formed Defense Department agency was facing a number of challenges in its efforts to transform its business, consolidate systems and processes, and modernize its technology. We began having conversations with the executive leadership and department heads across different lines of business to gain a clear understanding of their mission, current challenges and desired outcomes. As the ServiceNow program was being established at the agency, the customer required a robust governance and platform team to ensure utilization of development best practices and policy generation, platform management activities (e.g., upgrades) and a secure, scalable, federated development model. This technical rigor and governance structure supported the creation of a stable environment in which application development teams could configure and deploy new, unique applications rapidly.”

Read more insights from Kyle McKendrick, senior enterprise account executive at ServiceNow, and Daniel Gruber specialist managing director at KPMG.

Driving Modernization with Deep Strategic Partnerships

“In response to the challenges agencies face, Leidos has been focused on building deep strategic partnerships that help us create at-scale solutions for our government customers. These partnerships are characterized by a commitment to open lines of communication and transparency in terms of strategy and investments. We also operate in what we describe as a badgeless environment in which experts from different companies work side-by-side to engineer new capabilities and solutions.”

Read more insights from Derrick Pledger, senior vice president and CIO at Leidos.

Why Success in Zero Trust Requires a Team Effort

“Zero trust focuses on the connection between users and the data, applications, networks and systems they want to access. In zero trust architectures, new administrative tools continually evaluate whether allowing an individual user to have a certain level of access privileges is the right thing to do. The approach gives agencies much more flexibility as they modernize because they can make decisions at a granular level that enable them to secure data and entire IT ecosystems.”

Read more insights from Meghan Good, vice president and director of the Cyber Accelerator at Leidos.

How Multi-Domain Operations Accelerate Modernization

“By design, multi-domain operations must involve a broad range of partners to achieve the desired mission outcomes, particularly as threats continue to rapidly evolve. Making such a shift allows military and civilian agencies to far more rapidly add new capabilities to individual systems. The approach also enhances agencies’ ability to partner with industry to harness the power of cross-domain, cross-agency and even cross-company digital synergies.”

Read more insights from Chad Haferbier, vice president of multi-domain operations solutions at Leidos.

Balancing Speed and Security with SecDevOps

“As one of the largest systems integrators, Leidos understands the government’s mission domain and individual agencies’ unique challenges. We also know where they are in their evolution. Some are still easing toward agile and SecDevOps, whereas others have fully embraced those approaches. Our partners in the commercial world are some of the fastest, most forward-leaning technologists.”

Read more insights from Paul Burnette, vice president and director of the Software Accelerator at Leidos.

Download the full Innovation in Government® report for more insights from SI cloud thought leaders and additional industry research from FCW.

Higher Education All-In on Cloud-First

Posted on by Tim Boltz

Is digital transformation in higher education possible without the cloud? Not likely. When that transformation is viewed as a journey, not a destination, the essential role of cloud-based resources as enabling and empowering infrastructure comes sharply into focus. Institutional performance, operational efficiencies, student success — the primary goals of digital transformation in higher education today — are only possible with the agility and scalability of cloud-based computing and resources.

Without a clear strategy in place, digital transformation and cloud migration can start to look like a game of whack-a-mole. As teams weigh where cloud solutions will take them next, understanding and articulating the need to include data-intensive computing, security, reporting, and analysis is imperative. That’s all the more true as students increasingly demand a level of personalization and engagement that can only be delivered through a robust analytics and data infrastructure. Download the guide to learn how to grow beyond today’s analytics programs and to mature them for endemic management and strategy.

Cloud Budgets Keep Growing

“‘As higher education institutions continue to pivot toward continuous modernization practices, the SaaS segment of the cloud is likely to see the most investment,’ noted Damien Eversmann, Chief Architect for Education at Red Hat. ‘Cloud resources provide the agility and flexibility needed to support the culture of change that continuous modernization demands. As long as security practices are properly maintained, cloud adoption is one of the best tools for academic institutions to stay ahead of the curve.’ All cloud categories are expected to see growth in 2023, according to Gartner, with the most significant anticipated growth in Cloud Management and Security Services and Cloud Application Infrastructure Services (PaaS).”

Read more insights from Damien Eversmann, Chief Architect for Education at Red Hat.

Accelerate Agility and Integrate Data

“Today, higher education IT professionals refer to “the new normal” when discussing the many modes of learning, research, and other day-to-day hybrid work now possible thanks to cloud computing. The monumental movement and general acceptance of the cloud within higher education happened nearly overnight, after years of hesitance and reluctance on the part of higher ed leaders who sought greater on-site control over data and operations. That reluctance transformed to trust as cloud-based operations proved their mettle, and institutions by and large today embrace a new way of working through the ongoing and continuous change of digital transformation. “That’s probably the biggest change — that change is the constant,” said Bill Greeves, an industry advisor for SAP who supports the organization’s education customers. As a former CIO and deputy county manager for Wake County, N.C., Greeves saw firsthand the overnight transformation to cloud-based workloads to keep government and citizen services up and running at the onset and throughout the pandemic.”

Read more insights from Bill Greeves, Industry Advisor for SAP.

Essentials for Navigating Cloud Implementations

“While the mission of higher education has never changed, the means of fulfilling that mission continue to swiftly evolve, particularly as a result of cloud computing technology and the migration of workloads, applications, storage — pretty much everything — to the cloud. Higher education research, in particular, enjoys many benefits from the cloud, including rapid provisioning of data and applications, or abstraction, which ensures non-technical users can readily deploy cloud resources and quickly get back to the real task at hand: research. Cloud is at the heart of institutions’ ongoing march to digital transformation, but that’s not all: Prompted by the pandemic, many colleges and universities have also embraced the rapid adoption of cloud capabilities in support of remote work and collaboration.”

Read more insights from Hunter Ely, Security Strategist at Palo Alto Networks, and Mathew Lamb, Manager, Pre-Sales Cloud Native Solutions at Palo Alto Networks.

Download the full report for more insights from these from these higher ed Cloud leaders as well as additional perspectives and industry research.

The Open Source Revolution in Government

Posted on by Natalie Gregory

Open source technology accounts for a significant portion of most modern applications, with some estimates going as high as 90%, and it is the foundation of many mainstream technologies. Its strength lies in the fact that a vibrant ecosystem of developers contribute to and continually improve the underlying code, which keeps the software dynamic and responsive to changing needs. Enterprise open source software further augments these community-driven projects by providing enterprise-grade support and scalability, while retaining the innovation and flexibility driven by the open source development model. By providing the best of both worlds, such solutions represent a powerful arsenal of tools for addressing government’s most pressing challenges. In a recent pulse survey of FCW readers, 93% of respondents said they were using open source technology. And more than half of respondents to FCW’s survey see open source as an integral resource for strengthening cybersecurity. That number reflects a positive trend toward a better understanding of open source software’s intrinsic approach to security. The power of enterprise open source technologies lies in a combination of collaboration, transparency and industry expertise. As agencies expand their use of such technologies, they maximize their ability to achieve mission success in the most secure, agile and innovative way possible. Learn how the combined power of community-driven innovation and industry-leading technical support is expanding the government’s capacity for transformation in Carahsoft’s Innovation in Government® report.

Why Open Source is a Mission-Critical Foundation

“Open source transforms the way agencies manage hybrid and multi-cloud environments. The most critical technology in the cloud, across all providers, is Linux. Everything is built on top of that foundation — both the infrastructure of the cloud and cloud offerings. Given the right partner, the promise of Linux is that it provides a consistent technology layer for agencies across all footprints, including multiple cloud providers, on-premises data centers and edge environments. From that foundation, agencies and their partners can build portable architectures that leverage other open source technologies. Portability gives organizations the ability to use the same architectures, underlying technologies, monitoring and security solutions, and human skills to manage mission-critical capabilities across all footprints.”

Read more insights from Christopher Smith, Vice President and General Manager of the North America Public Sector at Red Hat.

How Open Source is Expanding its Mission Reach

“The real power of open source technologies was revealed when they cracked the code on being highly powered, mission-specific, distributed systems. That’s how we are able to get insights out of data by being able to hold it and query it. Today, open source innovation is being accelerated by the cloud, and the conversation is still changing, with people now demanding that their open source companies be cloud-first platforms. Along the way, the open source technologies that start in the community and then receive a boost of commercial innovation have matured. The most powerful ones are expanding their ability to address more of the government’s mission needs. They are staying interoperable and keeping the data interchange non-proprietary, which is important for government agencies.”

Read more insights from David Erickson, Senior Director of Solutions Architecture at Elastic.

The Open Source Community’s Commitment to Security

“A central tenet of software development is visibility and traceability from start to finish so that a developer can follow the code through development, testing, building and security compliance, and then into the final production environment. Along the way, there are some key activities that boost collaboration and positive outcomes, starting with early code previews, where developers can spin up an application for stakeholders to review. Other activities include documented code reviews by peers to ensure the code is well written and efficient. In addition, DevOps components such as open source, infrastructure as code, Kubernetes as a deployment mechanism, automated testing, and better platforms and capabilities have helped developers move away from building ecosystems and instead focus on innovation.”

Read more insights from Joel Krooswyk, Federal CTO at GitLab.

The Limitless Potential of an Open Source Database

“One of the most important elements of any database migration is ensuring that proper planning and due diligence have been performed to ensure a smooth and successful deployment. In addition, there are some key considerations agencies should keep in mind when moving to open source databases. It is essential to start with a clear understanding of the business case and objectives for adopting an open source approach. Agencies also need to decide how the database should function and what it should do to support their digital transformation. Then they must choose the optimal method to deploy the database.”

Read more insights from Jeremy A. Wilson, CTO of the North America Public Sector at EDB.

Modernizing Digital Services with Open Source

“A composable, open source digital experience platform (DXP) enables agencies to overcome those challenges. Open source technology is continuously contributed to by a community of developers to reflect a wide array of needs across organizations in varying industries and of varying sizes. A composable approach allows agencies to assemble a number of solutions for a fast, efficient system that is tailored to their needs. When agencies combine a composable DXP with open source technology, they have access to best-of-breed software and the ability to customize the assembly to suit their requirements. An enterprise DXP will enable agencies to achieve a 360-degree view of how constituents are engaging with their digital services and gain valuable data to understand how to enhance their experience. Finally, a composable, open source DXP provides a proactive approach to protecting against security and compliance vulnerabilities.”

Read more insights from Tami Pearlstein, Senior Product Marketing Manager at Acquia.

Creating Secure Open Source Repositories

“Protecting the software supply chain requires looking at every single thing that might come into an agency’s environment. To understand that level of visibility, I like to use the analogy of a refrigerator. All the ingredients necessary to make a cake or pie are in the refrigerator. We know they are of good quality, and other teams can use them instead of having to find their own. At Sonatype, our software equivalent of a refrigerator is the Nexus Repository Manager. A second aspect of our offering, called Lifecycle, allows us to evaluate the open source components in repositories at every stage of the software development life cycle. One piece of software can download a thousand other components. How do we know if one of those components is malicious?”

Read more insights from Maury Cupitt, Regional Vice President of Sales Engineering at Sonatype.

Better Data Flows for a Better Customer Experience

“A more responsive and personalized customer experience isn’t much different from the initial problem set that gave birth to Apache Kafka. When people interact with agencies, they want those agencies to know who they are and how they’ve interacted in the past. They don’t want to be asked for their Social Security number three times on the same phone call. They also expect that the information or service they receive will be the same whether they are accessing it over the phone, via a mobile app and on a website. To elevate the quality of their service, agencies must be able to stream information in a low-friction way so different systems are consistent with one another and up-to-date at all times, regardless of the communication channel an individual uses. President Joe Biden’s executive order about transforming the federal customer experience is based on this capability. The most successful companies across industries have figured out how to do it, and for the most part, they’ve done it with open source software.”

Read more insights from Jason Schick, General Manager of Confluent US Public Sector.

An Open Source Approach to Data Analytics

“For the past 40 years, agencies have used data warehouses to collect and analyze their data. Although those warehouses worked well, they were limited in what they could do. For instance, they could only handle structured data, but by some estimates, 90% of agencies’ data is unstructured and in the form of text, images, audio, video and the like. Furthermore, proprietary data warehouses can show agencies what has happened in the past but can’t predict what might happen in the future. To achieve the government’s goal of evidence-based decision-making, agencies need to be able to tap into all their data and predict what might come next.”

Read more insights from Howard Levenson, Regional Vice President at Databricks.

Download the full Innovation in Government® report for more insights from these open source thought leaders and additional industry research from FCW.