The available detail programs, listed under the Open Opportunities page of USAJobs, are designed to help cybersecurity personnel, especially those that graduated from the recent cyber reskilling academy but lack practical experience, to gain the hands-on tools to advance in their cyber careers in the federal government.

“We cannot overcome the shortage in the federal cybersecurity workforce overnight,” said Federal Chief Information Officer Suzette Kent in a news release.

“By continuing to invest and support reskilling programs, coupled with hands-on opportunities to apply those skills, the federal government is positioning itself to strengthen our cybersecurity workforce capabilities.”

Initial graduates of the cyber reskilling academy have struggled to find federal positions that offer the same pay grade as their old work but in their new field, in part because those graduates did not have years of cyber-specific experience to qualify for the job.

OMB officials have hinted in the past that a detail program would be necessary to make sure those employees got the experience they needed while remaining in government.

Opportunities are currently available for nine different positions across three agencies: the Environmental Protection Agency, the Department of Homeland Security and the Department of Veterans Affairs.

Though the EPA has the largest number of opportunities at six, those details only call for one person to fill the slot. The DHS and VA opportunities call for anywhere between two to five people or more.

The Open Opportunities program is managed by the Office of Personnel Management and currently boasts over 60 available opportunities for feds to present their knowledge or work with other teams within the government to gain and offer skills.

“By serving as a governmentwide bulletin board for short-term assignments, details and training opportunities around the federal government, Open Opportunities will help agencies tap into the valuable talent and skills we already have and are developing within government,” said OPM Director Dale Cabaniss in a news release.

The positions all start at GS-12 and above, and are not open to the public, meaning that the Air force plans to hire current and former feds, military veterans and family members of feds or military members serving overseas. Some of the positions are reserved for current federal employees working for the Air Force.

Feds with program analyst expertise that wish to work for the Space Force are especially in luck, as 13 of the open positions call for program analysts to help set operational priorities for the new force. Human resource specialists are the next most sought after position to plan for future hiring, training and workforce management.

The Air Force is also targeting a short turnaround for these positions, as many close less than two weeks after posting. Interested feds will have to submit materials by the end of the month for a majority of the positions listed.

Employees will also have to obtain and maintain secret or top secret clearance for most positions.

With facilities across the globe sharing information, the State Department depends on information systems to carry out its work. But, the inspector general found “numerous control weaknesses …. affected program effectiveness and increased the Department’s vulnerability to cyberattacks and threats.”

According to the inspector general, the department hasn’t fully implemented its risk management strategy and has dispersed cybersecurity authorities across the department. The IT leadership structure has prevented the department CIO from being accountable for information security issues.

For example, State’s Bureau of Diplomatic Security, which has some cybersecurity authorities, doesn’t report to State’s CIO, the IG wrote. The IG report adds that the CIO doesn’t have the ability to track and control IT investments.

Meanwhile, the IG noted, some overseas information systems security officers (ISSOs) continued to fail to complete all their information systems security job requirements. This problem was first identified by the inspector general in 2017. The IG also found deficiencies in the department’s IT contingency planning at overseas posts and shortfalls in how the department tests for shortfalls in its IT systems.

For example, the IG found that there “no mechanism in place to communicate identified vulnerabilities to the system owner if a vulnerability was considered significant or required additional resources to remediate.”

“Without a systematic approach to monitoring networks and recording findings, department networks could be breached, and information security compromised,” the IG wrote.

Staffing

Staffing issues have plagued the agency as well, an challenge made worse by the hiring freeze that was instituted by President Donald Trump and continued for nearly a year and a half.

“OIG’s work finds that staffing gaps, frequent turnover, poor leadership, and inexperienced and undertrained staff frequently contribute to the Department’s other management challenges. Workforce management issues are pervasive, affecting programs and operations domestically and overseas and across functional areas and geographic regions,” the report said.

The freeze not only prevented the agency from bringing on new personnel, but also disrupted training and professional development programs, as heavy workloads and agencywide restrictions on detail assignments prevented such initiatives from moving forward.

The report identified underqualified and inadequately trained staff as an additional problem plaguing the agency.

Filling leadership positions also proved a significant management challenge for the agency, and those positions that were filled faced issues with accountability and adherence to department principles.

“A report on leadership within the Bureau of International Organization Affairs revealed numerous complaints, including allegations of disrespectful and hostile treatment of employees, unmerited accusations of disloyalty, and retaliation based on conflicts of interest,” the report said.

“Many leadership concerns associated with the National Passport Center in New Hampshire were also reported to OIG, prompting a targeted review. Employees reported widespread inappropriate behavior that included allegations of retaliation, such as denying awards, promotions, and special assignments and pursuing meritless disciplinary actions; multiple incidents of sexual and gender-based harassment; and multiple accounts of subtle or blunt intimidation.”

The Government Accountability released a report Oct. 31 assessing the bureau’s preparation for the 2020 Census, calling progress “generally on track to meet key deadlines.” However, two key requirements for success are behind schedule, which could grow into a significant problem if not addressed.

IT progress a mixed bag

Census Bureau — charged with administering the decennial count — has 15 systems potentially following behind development and testing milestones.

The systems, which play various roles in six of 16 operational deliveries designated for census completion, add “uncertainty to a highly compressed time frame for completing system development and testing work over the next 7 months,” the GAO wrote.

The systems considered at risk perform various functions, including customer support during “self-response,” or responding to the census online. Other functions include data collection, business and support automation, customer support and field operations.

The GAO also found that the Census Bureau had progressed on IT security assessments, with 48 of its 52 total systems authorized to operate through the count. Three systems either need to be reauthorized or do not currently have ATOs. One system doesn’t need an ATO.

“Going forward, it will be important that the bureau effectively manages these system risks to better ensure that it meets near-term milestones for system development and testing, and is ready for the major operations of the 2020 Census,” the GAO wrote.

Workforce shortfalls

The Census Bureau has also struggled to hire and keep the number of temporary employees it needs, despite plans for fewer of such personnel in the 2020 count.

“The bureau is experiencing delays in hiring for early operations, citing delays in processing background clearances and greater than expected attrition,” GAO wrote.

The bureau anticipated that 60 percent of those applicants that accepted a job offer would complete the fingerprinting, background investigation and training process. In reality that number was only 32 percent.

For example, the agency expected to have 40,300 listers – those employees that canvass houses to confirm addresses – by September 2019, but only managed to onboard 31,151 by that time.

“Though address canvassing productivity was higher than expected, based on our observations, in some parts of the country the operation was at risk of falling behind because of a shortage of listers. The Bureau told us it had to fill the gap with listers who lived well outside of the area they were supposed to work—in some cases from a different state,” GAO wrote.

Background investigation wait times have dogged many agency hiring efforts, as potential employees may choose to back out of a job that they are unable to start right away because of the time it takes to process a clearance.

In the Census Bureau’s case, the background investigation problem is due to another staffing shortage as the agency reported that it did not have enough personnel early on to review clearances, particularly those applications that had been incorrectly filled out.

The agency then began to bring on 130 temporary staff in February 2019 to expedite the application review process.

“The Bureau plans to address these challenges by adapting its hiring and onboarding process for peak operations in May 2020, including recruiting more applicants, expanding the number of locations for selected applicants to get fingerprinted and providing additional training for replacement hires,” GAO wrote.

Despite the challenges, an overall checkmark for progress by GAO is good news for the bureau, after being placed on the GAO’s high risk list in 2017 for “significant concerns” about its development and acquisition operations.

The program provides grants to accredited, four-year universities to support the development of intelligence-related curricula and courses.

But according to a Government Accountability Office report issued Aug. 1, the DIA, which manages the program’s operations, hasn’t adequately kept track of whether the grants invested have yielded the desired results of increasing IC diversity.

“Specifically, while DIA has developed some short-term goals and plans for the program, DIA has not established results-oriented program goals or an overall strategy that details the agency resources and processes required to achieve the program’s mission,” the report said.

“Similarly, DIA collected some data for the program and required colleges to provide reports on significant program accomplishments, but these data are not complete or reliable and have not been used to comprehensively evaluate the program’s success.”

The IC is projected to ultimately spend $69 million on the program from its inception in 2005 into 2021. So far, 29 colleges have received 46 grants during that time.

But according to GAO, DIA has not ensured that other intelligence agencies are sufficiently participating in the program, despite the continued awarding of grants to universities.

“The IC CAE program is a collaborative effort that allows IC elements to participate in college events, such as IC CAE recruitment events. However, not all IC elements participate in the program,” the report said.

“As IC CAE program manager, DIA has engaged with IC elements in a variety of ways, but this engagement has not resulted in consistent participation among the IC elements. Moreover, program documentation has not clearly defined IC elements’ roles and responsibilities for participation.”

Oversight of the program has also remained transitory, as the centers were originally under the oversight of the Office of the Director of National Intelligence until 2011, when they were placed under DIA’s oversight. ODNI officials told GAO that they intend to transition the program back to their own office in fiscal year 2020.

GAO recommended that the Office of the Director of National Intelligence establish results-oriented goals for the program, develop strategies to achieve those goals, identify and evaluate external factors that could impact the program’s ability to achieve those goals, document performance measures for the program, develop a plan for periodically evaluating the program’s performance, assess why some intelligence agencies are not participating in the program and address those reasons, and define the intelligence agencies’ roles and responsibilities for participating in the program.

ODNI agreed with the recommendations, but did not outline the steps it would take to implement them.

Of those systems, GAO identified 10 across an equal number of agencies that are in critical need of modernization, due to the age of the system, its criticality to the agency and the security risk it poses.

The systems themselves were not named, due to the potential security risks such a disclosure would pose, but were given generic descriptions and locations in the report:

1. Department of Defense — a maintenance system supporting wartime readiness
2. Department of Education — a system housing student information
3. Department of Health and Human Services — an information system supporting clinical and administrative activities
4. Department of Homeland Security — a network of routers, systems and appliances
5. Department of Interior — a system supporting the operation of dams and powerplants
6. Department of Treasury — a system containing taxpayer information
7. Department of Transportation — an aircraft information system
8. Office of Personnel Management — hardware, software and service components supporting IT applications and services
9. Small Business Administration — a system controlling access to applications
10. Social Security Administration — a group of systems housing information on Social Security beneficiaries

Those 10 systems cost approximately $337 million for their agencies to maintain, and can be expected to increase expenses and exposure while decreasing mission efficiency.

“Among the 10 most critical legacy systems that GAO identified as in need of modernization, several use outdated languages, have unsupported hardware and software, and are operating with known security vulnerabilities. For example, the selected legacy system at the Department of Education runs on Common Business Oriented Language — a programming language that has a dwindling number of people available with the skills needed to support it,” the report said.

“Further, several of these legacy systems are also operating with known security vulnerabilities and unsupported hardware and software. For example, DHS’s Federal Emergency Management Agency performed a security assessment on its selected legacy system in September 2018. This review found 249 reported vulnerabilities, of which 168 were considered high or critical risk to the network.”

The Treasury manages the oldest system at 51 years, but the Department of Education and HHS both manage systems that are over 45 years old, which are both high-criticality and high-risk.

Both agencies, along with the Department of Transportation, have also failed to establish modernization plans.

Only the DoD and DOI have established complete modernization plans that include three essential components.

“According to our review of government and industry best practices for the modernization of federal IT, agencies should have documented modernization plans for legacy systems that, at a minimum, include three key elements: (1) milestones to complete the modernization, (2) a description of the work necessary to modernize the legacy system, and (3) details regarding the disposition of the legacy system,” the report said.

GAO made one recommendation to each of the eight agencies that did not already have a complete IT modernization plan in place, and all eight agreed with the recommendation.

The White House’s National Science and Technology Council Subcommittee on Quantum Information Science issued a request for information May 30 “to inform the subcommittee as the government develops the means to address the specific policy recommendations included in the strategic overview and the overall goals of the National Quantum Initiative Act.”

That legislation requires the government to create a 10-year plan for accelerating quantum innovation and its uses in information science and technology.

Quantum computing is a relatively new field, first theorized in the 1980s, that aims to address problems that regular computers don’t have the capacity to solve by using the principles of superposition and entanglement.

Some experts have said that once quantum computers become more operational, they could render modern forms of cybersecurity obsolete, as the quantum computer is able to simultaneously test a large number of passwords or encryption keys that the standard computer can’t keep up with.

Many nations have therefore invested heavily in quantum research in order to get out ahead of that possibility.

The quantum RFI asks respondents to address eight questions:

1. What specific actions could the U.S. government take that would contribute best to implementing the policy recommendations in the National Quantum Initiative Act’s strategic overview?
2. What are the scientific and technological challenges that, with substantial resources and focus over the next ten years, will transform the quantum information science research and development landscape?
3. Regarding industrial engagement, what roles can the U.S. government play in enabling the innovation ecosystem around QIS-related technologies? Are there critical barriers for industrial innovation in this space? How can these barriers be addressed? What role can the U.S. government play in mitigating early or premature investment risks?
4. How can the U.S. government engage with academia and other workforce development programs and stakeholders to appropriately train and maintain researchers in QIS while expanding the size and scope of the `quantum-smart’ workforce?
5. What existing infrastructure should be leveraged, and what new infrastructure could be considered, to foster future breakthroughs in QIS research and development?
6. What other activities/partnerships could the U.S. government use to engage with stakeholders to ensure America’s prosperity and economic growth through QIS research and development?
7. How can the United States continue to attract and retain the best domestic and international talent and expertise in QIS?
8. How can the United States ensure that U.S. researchers in QIS have access to cutting-edge international technologies, research facilities, and knowledge?

Responses to the RFI are due by July 29 to either nsfscqis@nsf.gov or via a designated survey site.

Over six decades later, members of Congress, federal agencies and the private sector will meet in a similar fashion in a Cybersecurity Solarium Commission to address the cybersecurity threat to the United States, both on a governmental and private sector level.

The commission includes four members of Congress from all parties: republicans Sen. Ben Sasse of Nebraska and Rep. Mike Gallagher of Wisconsin; democratic Rep. Jim Langevin of Rhode Island; and independent Sen. Angus King of Maine.

On the agency side, Department of Defense acting-Deputy Secretary David Norquist, Department of Homeland Security acting-Deputy Secretary David Pekoske, Deputy Director for National Intelligence Susan Gordon and FBI Director Chris Wray will also serve on the commission.

On top of the eight government members, the commission will also have six members from the private sector, many of whom have former government or academic experience.

According to King, a co-chair of the commission along with Gallagher, the members will break into three groups to address facets of the cybersecurity issue: persistent engagement, deterrence and international norms and standards.

Engagement and deterrence are “similar but not identical,” according to King, who spoke on a call with reporters May 13, as the first ensures that cyber adversaries know the United States is watching and investigating them, while deterrence includes capabilities and repercussions that keep adversaries from engaging in the first place.

The groups have yet to be determined, according to King, but commission members have been asked to submit their interest in each of the three areas.

The commission was also granted a budget to hire staff in the 2019 National Defense Authorization Act, which first granted authority for the new Solarium.

“We’re going to get the best talent that we can,” said King.

Despite the commission’s broad range of issues it plans to address in the coming months, King said he hopes to be “as specific as possible” in recommendations so that cyber adversaries “understand what the rules of the game are.”

In the coming weeks, the commission plans to issue more details on staff positions and how people can contribute to discussions, and a full report on each of the three groups’ findings is expected by the end of the year.

According to both industry and government experts that spoke at a May 8 ACT-IAC event, applying a “zero trust” model to agency cybersecurity could provide an ideal route to protecting sensitive government data, while checking the boxes on many government security requirements.

Zero trust is not a product, said Sean Frazier, advisory chief information security officer for federal at Duo Security. Rather, zero trust is a mindset where no user is automatically deemed trustworthy, and every system must verify the user before granting access.

“It’s a direct conversation between a user and an application on a device,” said Frazier.

Effectively, a zero trust framework ensures that every system verifies the identity of the user and their authority to access various types of information before granting access to its data or operations. And just because one system granted a person access, doesn’t mean that the user suddenly has the ability to see everything on the network.

But according to Lisa Lorenzin, that doesn’t mean that systems should feel more closed off than they were before zero trust was implemented.

“‘Zero trust’ is a misnomer. You start off by not implicitly trusting anyone, but that’s not our goal. Our goal is to figure out who we can trust, how we know we can trust them and what we trust them to do or to access,” said Lorenzin.

“For me, zero trust is a way to ensure that the end user can get to whatever they need with as little friction as possible, and everything else is window dressing. We need to take cybersecurity from the group that says ‘no’ to the group that says ‘yes,’ and I think zero trust is how we do that.”

Despite the fact that zero trust is a mature and tested cybersecurity model, according to Lorenzin, it may take the federal government some time before that model can be widespread, no matter how well it works.

Steven Hernandez, director for information assurance services and CISO for the Department of Education, said that federal agencies can’t be like private sector companies such as Google, which revamped its entire architecture to adhere to a zero trust model.

“Don’t expect all agencies to put out one requirement that’s going to say, ‘yeah, I want zero trust.’ It’s going to look different, it’s going to feel different, but it’s all going to have some kind of intersection with zero trust,” said Hernandez.

Limited budgets, deeply entrenched legacy IT systems and inadequate IT workforces can all hold back a wholesale transition into zero trust-based cybersecurity.

Meanwhile, agencies should look into ways that they can map their “crown jewels” up to a zero trust framework, according to Hernandez, and work on getting the rest of their data into a zero trust model in the future.

“Zero trust implementations will need to be very scalable,” said Jeffrey Flick, acting director of the Enterprise Network Program Office at the National Oceanic and Atmospheric Administration.

According to Hernandez, the side benefits of zero trust can also be used to sell the concept to agency leadership.

“Zero trust can drive a lot of the existing compliance programs we already have, if we do it right,” he said, adding that the model can allow agencies to maintain that compliance while expanding the devices or locations where users can access agency systems.

“That’s how we’re going to sell zero trust if we’re going to be successful. We’re going to show that, instead of government-furnished equipment with five-factor authentication for getting through, adding tons of latency, we’re going to say ‘any device, anywhere, with very simple authentication to get into that data.’”

But some members of Congress worry that such policy priorities are not reflected in the budget plans the Trump administration has proposed, shortchanging components of the Department of Homeland Security, in particular, that are responsible for leading cybersecurity efforts.

“Despite [the Cybersecurity and Infrastructure Security Agency]’s growing mission, its budget has remained stagnant. Since taking office, the president and those around him have paid a lot of lip service to cybersecurity and innovation, but there hasn’t been much follow through,” said Rep. Cedric Richmond, D-La., at an April 30 House Committee on Homeland Security hearing.

“To complicate matters all of this is happening in the absence of a White House cybersecurity coordinator, which the White House eliminated last year.”

White House budget documents requested approximately $1.28 billion for CISA’s operations and support for fiscal year 2020, while Congress approved nearly $1.35 billion for the same programs 2019. It also authorized an additional $336 million for procurement, construction, research and development for the new agency.

DHS’s Science and Technology Directorate also received a significantly reduced budget in the president’s proposal, going from nearly $820 million in FY19 to a proposed $582 million in 2020.

That reduction would cause the agency to close down some programs, such as established Centers of Excellence that work to develop cybersecurity and technology solutions for state and local partners.

“I support the president’s budget. Having said that, I certainly appreciate the resources that Congress has provided over the years and the support to the S&T folks and the mission that we have. All of our Centers of Excellence provide great value,” said William Bryan, senior official performing the duties of the under secretary of the Science and Technology Directorate.

“Under the proposed budget, we’re going to have to look at the Centers of Excellence — two of them frankly — that are going to have to be shut down, in the hope that we can start up three other ones, should the president’s budget be executed.”

Those potential closures include the National Urban Security Technology Laboratory in New York, which develops technologies for first responders.

“Tough decisions have to be made,” said Bryan. “The only remedy I have is to look to where capabilities like these can be performed elsewhere.”

Meanwhile, Christoper Krebs, CISA’s director, said that requests for his department’s assistance in securing 2020 elections are ramping up, and the money for those initiatives “has got to come from somewhere.”

CISA currently has approximately 1,100 cybersecurity personnel with 361 positions vacant.

“When we look at the budget, particularly from a personnel perspective, we are still growing as an agency, we are still filling billets,” said Krebs, who said that he would have ways to spend money even if his agency’s budget were doubled.