That emphasis isn’t new at DISA, where specific goals and requirements help spur the agency to fully embrace the innovation small businesses can offer. The Office of Small Business Programs functions as the principle advocate for small businesses within the agency, leveraging its position as the primary adviser to the director, senior leaders, workforce and industry on all aspects of programs “to ensure the continuous growth of the small business industrial base that supports information technology products and services for the global war fighter.”

Carlen Capenos took over as the director of the Office of Small Business Programs in August, as the office was coming off a strong fiscal 2018 — spending $1.72 billion and surpassing its small business goal of 28 percent.

Capenos talked to C4ISRNET’s Brandon Knapp about her plans to find areas for improvement and continuing the office’s success — or, as she puts it, “not trying to fix what doesn’t need to be fixed.”

C4ISRNET: Share a little about your background and how it has equipped you for your new position as the director of Small Business Programs at DISA.

CARLEN CAPENOS: I have 22 years of federal service. I’ve spent 17 of those in contracting, so I have a solid background in contracting. I’ve worked for the Air Force, for the Army. And the last three years I’ve worked for DISA. For the Corps of Engineers, I did a job for a couple of years for the construction industry. I think all those things rolled together allow me to have a good solid basis for being this director and helping DISA and its mission, as well as the small businesses in our industry.

C4ISRNET: Why is it important for DISA to have a good relationship with the small business community?

CAPENOS: The first thing is that it’s the law. So, to be compliant, we’re going to do it. But it behooves us to do it well. And it behooves us to have the relationships with industry to help us when we need help and support them when they need support.

But really the bottom line of our goal is to deliver what our war fighters need. And a lot of times the small businesses can do it and will do it. That allows us to meet our statutory goals and law-based requirements, but really when they have the best answer and can get us a solution quickest — that’s the real priority for us to have the relationships with the small businesses. Because in the end, it is all about the war fighter.

C4ISRNET: What are you particularly excited about at DISA in the next year or so?

CAPENOS: I’m super excited about SETI, our systems engineering, technology and innovation requirement. So much of the focus of that contract really was about bringing innovative small businesses to DISA. As we were working toward that request for proposals we asked, “How can we remove barriers to get those innovative small businesses to come to us and want to work with us?” And we developed SETI around that.

In my new role, I still want to have an active part in getting those small businesses into DISA to figure out what DISA’s main innovative challenges are and to set up a forum that works for DISA and for industry. Whether it’s through the SETI vehicle or through our [other transaction authority] process or any other way that can be advantageous for small businesses, for DISA and, most importantly, the war fighter.

C4ISRNET: How do you see the Office of Small Business Programs’ role externally in working with these businesses?

CAPENOS: We need to be the advocates for the small business. We spend a lot of time meeting individually with small businesses. We do a monthly group meeting with small businesses that are either new to federal contracting or new to DISA, so we can show them how we’re organized, how we execute contracts, programs that we have upcoming, and a lot about how to find information and where to get information.

C4ISRNET: What about advocating for the small business community within DISA?

CAPENOS: We also teach internally. We teach our contracting folks. We work with them on doing market research and we work with them on their acquisition strategies: Should we set this aside for small business? Should we not set this aside? If we’re going to set it aside, can we hit one of the other federally designated categories?

Because we report directly to the commander, we also are leadership’s eyes and ears for small business. We apprise them of where we are, where we’re going … any issues, concerns. Once contracts are awarded, we also can be involved if there are issues with performance, to help improve performance or to see what we can do to facilitate corrective actions. We do whatever’s necessary to make sure that small businesses have a voice.

C4ISRNET: What aspects of the IT community are challenging for small businesses?

CAPENOS: The issues that we’re starting to see for small businesses, though it hasn’t really come directly to us at DISA, include the fact that the requirements for all the cybersecurity can be very expensive. There have been some questions about whether the government is doing anything for the industry to help out with all those requirements. I think the cost of doing business with the federal government — to keep our data and networks safe and secure — is a challenge for small businesses when trying to meet all the requirements and pay for it.

C4ISRNET: What unique advantages do small businesses bring to the table in the IT space?

CAPENOS: What I would say is very desirable with the small business side is they’re generally the ones that spur the innovation and have the solutions to the problems that we have, or problems that we don’t know we have yet. It’s on us as an agency to facilitate a way for nontraditional companies to get into the federal government. It’s on us to clear out the red tape, to remove some of the requirements and to figure out how we best make it easy to do business with us.

C4ISRNET: What can small businesses do to improve their ongoing relationship with DISA?

CAPENOS: The biggest thing they can do is respond to our sources-sought notices. When we post stuff out there saying, “Hey, small business can you do this? Do you want to do this? How can you help us with that?” That’s a really great step to indicate that they can do the work we have and they want to do the work we have. And then engaging with our events; for instance, Forecast to Industry days to hear about what DISA is doing.

C4ISRNET: Are there any areas of small business contracting where you think DISA has room for improvement? For example, the previous director of Small Business pointed to HUBZone small businesses as an area that needed to improve.

CAPENOS: The good news is that we met all our goals for our socio-economic categories this year, so we don’t have to focus on a specific area. We can really look at how can we get the best small businesses — whether they are HUBZone, service-disabled veteran-owned, women-owned, or just plain small business. Or if it’s something that’s not suited for them, then we have to make sure that on the other circuit stuff that we have solid subcontracting goals and evaluating participation plans.

C4ISRNET: What are you doing to reach out to industry and to get better acquainted with their concerns on an individual level?

CAPENOS: One thing that we’re working on is putting together a small SurveyMonkey questionnaire for industry, large and small, to ask what this office is doing well that we should continue to do and what we are doing that we shouldn’t be doing. But, most importantly, what we are doing for them.

C4ISRNET: How do you see the future of small businesses as potential prime contractors. Is that an area you see as having a viable future?

CAPENOS: Absolutely. When we’re looking at the increase of the DoD’s budget, that means that we can do more, and we’ve seen that this year in four of our five categories. We’ve executed and obligated more dollars for each of those categories than we have ever at DISA. And some of that is because we know small business can do this work, so we’re setting more things aside. But with the increase in the dollar value it means there is more things we can do to execute programs now instead of later.

DISA and our small businesses have shown historically that they can do it. So, it’s not hard to twist the arms of program managers to say, “Yeah, this one small businesses can do.” The good news is we have that history and we have that support from leadership top down. DISA considers every requirement for small business first.

C4ISRNET: In your view, is the small business community adapting in ways that make them more attractive to DISA or are you seeing stagnation?

CAPENOS: The challenge is really for DISA to keep up with small business. We need to learn how to be more flexible and less stagnant on how we approach small business, how we get them under contract, how we utilize [other transaction authorities] and those are things that we are working on.

I really think they have what we need, we just need to find the avenues to get them under contract, find the right pots of money, that kind of stuff. I think with these healthy DoD budgets, that’s good for everybody — most importantly the war fighter — that those problems will be quickly solved.

C4ISRNET: The Department of Defense is receiving record levels of funding from Congress. How do you expect this healthy budget to affect the Office of Small Business Programs and what does it mean for small businesses?

CAPENOS: The increase in the DoD budget is good news for DISA and for [the Office of] Small Business Programs. We saw record dollar amounts awarded in four of the five federally designated categories in fiscal year 2018. We expect this to continue. Bigger budgets mean more requirements can be executed — and with DISA’s small business-first policy, that means more opportunities available. For the requirements that aren’t well-suited for small businesses to prime, it’s still good news — there will be more opportunities for subcontracting.

The contracting process across the Department of Defense is often notoriously slow. But lag times in getting satellite bandwidth can cause problems for soldiers on the front lines, who rely on the technology to communicate on the battlefield.

Speaking on a panel at the Association of the U.S. Army’s annual meeting, Mike Nichols, DISA’s chief of commercial satellite communications technical support, described an idea that would allow the agency to get bandwidth to the battlefield faster.

“If I hear one thing back from our customer community and leadership, it’s that we need to acquire faster,” Nichols said. “So that is a charter that we have taken on, how can we improve the acquisition process.”

Nichols said DISA is exploring establishing a core network, which would feature an on-demand capability and allow defense customers to quickly meet their bandwidth demands.

“We would have a core network that provides capacity and various bands,” Nichols said. “Customers have a demand for service. We would already have a core network in place, in various bands for various services that would essentially lead to a very rapid ability to acquire that bandwidth.”

DISA currently has 91 contracts and task orders in place for commercial satellite communications.

The idea of a core network isn’t a new one at DISA, but thus far no defense organizations have been willing to provide the funds from their own budget to establish such a network. But Nichols said recent changes at the Pentagon may alter that calculation.

The National Defense Authorization Act for fiscal 2018 restructured satellite communication procurement efforts, moving satellite acquisition authority from DISA to Air Force Space Command in December 2018.

“We feel this transition to Air Force Space Command will be conducive to that change,” Nichols said.

“If the department is willing to stand up so we can get that preposition bandwidth in place in the areas that we need it, so when a customer comes, we’ve got that in place.”

Nichols also noted during the panel that two contracting mechanisms in place at DISA have been remarkably successful in accelerating acquisition: contract surges and blanket purchase agreements. Those agreements allow a single vendor to have a single management dashboard and streamlined approach for technical support.

“These have helped tremendously, but that’s not our end state,” Nichols said.

Most task orders can already be awarded by DISA within 17 business days, Nichols said, but the agency sees room for improvement within the “art of the possible.”

Dana Deasy, the department’s chief information officer, said Nov. 5 that he envisions the Joint Artificial Intelligence Center, or JAIC, to partner with U.S. Cyber Command and the Defense Information Systems Agency. Deasy was speaking at DISA’s annual Forecast to Industry day in Linthicum, Maryland.

“AI will serve us incredibly well inside DISA,” he said. “I think it will help us at U.S. Cyber Command. And I think it will help with reform efforts.”

Already, both organizations rely on automation to help weed out massive amounts of spam email and to help guard against cyberattacks.

“AI is moving at a rapid pace. There’s a huge appetite across the department to use it,” Deasy said of artificial intelligence. “But the resources we have right now are limited.”

More than 600 Defense Department programs are expected to touch on artificial intelligence in some fashion and the JAIC has been envisioned to help work with those programs with budgets larger than $15 million. Pentagon documents show the department expects to spend about $1.7 billion on the center in coming years. DoD officials submitted a formal artificial intelligence strategy to Congress last year and, notably, the controversial Project Maven program, which worked with Google to identify objects in drone footage, would fall under the center’s purview.

But since an announcement earlier this summer, the department’s leaders have offered few details about the mechanics of the center or how it would operate.

Deasy, a former CIO at banking giant JPMorgan and energy company BP, is overseeing the effort for now and said the center will focus on what he described as “cross-service solutions.”

“AI will become more than just a tool. I believe AI will be a partner, no doubt, first and foremost, from a lethality standpoint,” he said.

Lethality is one of three primary efforts by Defense Secretary James Mattis to improve the military.

Deasy also said he used a recent conference with the United States’ closest allies to talk with fellow leaders about how AI could help allies “fight better.”

Analysts at Gartner call this “remote browser isolation,” and they say it can reduce cyber risk across the enterprise.

The Defense Information Systems Agency put out a call to industry in June to determine whether an enterprise cloud-based internet isolation capability would be feasible. Now the agency says it is moving ahead with the idea.

The threat landscape

Defense planners say that they need a fundamentally new approach to cybersecurity because the threat landscape has changed in recent years.

“The browser has evolved and become more powerful than what it was years ago. It’s executing thousands of lines of code and bringing a lot of content back to that endpoint,” said Steve Wallace, technical director at DISA’s development and business center.

Two years ago, the agency started to explore the emerging browser-based threat. It hit upon a new approach that calls for browsing to take place on a commercial cloud, one that is not connected to Defense Department servers. In these cases, the end user will still interact with the internet, but all that will actually get through to the user is an image of the browsing session.

“This new technology would move [browsing] traffic at a collection point off of the DoD network and into a secure commercial cloud,” said Angela Landress, DISA’s Cloud-Based Internet Isolation program manager.

If hackers tried to exploit the browser, “all of that potentially malicious code or content wouldn’t touch the DoD network. Instead, it would be contained in the commercial data center, sanitized, inspected there,” she said. “It presents a much safer way to browse.”

DISA heard from 45 companies in response to a request for information and planners say this interest is driving an aggressive timeline. An initial prototype implementation to 100,000 users could come this spring, Landress said.

DISA officials say they don’t yet know whether the agency would award the project to a single vendor or to multiple contractors. “We’re going through our acquisition strategy right now. It could go either way,” Wallace said.

Sound strategy?

Technology analysts and cyber experts alike generally give high marks to a cloud-based strategy for isolating browsing activity, although some raise questions about how exactly this could be rolled out at scale.

As a general rule, “it’s good practice to segregate high-risk internet data from operational network,” said George Kamis, chief technology officer for global governments and critical infrastructure at security firm Forcepoint. “The DoD will certainly increase their security posture by implementing a cloud-based internet isolation solution.”

In addition to tightening security, the cloud approach also could have an operational impact, making it easier for soldiers in the field to access critical information.

Processing in the cloud rather than at the tactical edge, expeditionary forces with constrained communications could find their connectivity enhanced. “Sending pixels and compressed audio is less of an overall bandwidth requirement,” said Scott Scheferman, the director of global services for security solutions provider Cylance.

At the same time, experts raise concerns about the possible negative effects of shifting browsing to the commercial cloud.

“An isolation browser can impact user experience and usability,” Kamis said. Such tools “generally require users to take extra steps to enter and use that environment, and the browser is often restricted and pre-configured. This can impact productivity.”

Moreover, cloud-isolated browsing could lull users into a false sense of security.

“Obviously browsing is a risk, but the growth area in cyberattacks comes through content downloads and email attachments — Word attachments, PDFs and video files,” said Sherban Naum, senior vice president at cyber provider Bromium. “There is value in divorcing your browsing from the internet, but with an email attachment an attacker could still circumvent that entire process.”

While DISA planners recognize concerns around this emerging cyber strategy, they express confidence that the new architecture could be successfully deployed.

A simplified approach

Cyber strategies are naturally sophisticated: Engineers build up firewalls and other defensive mechanisms; they implement protocols that can slow computing and put in place elaborate security hoops through which end users must jump. DISA is eyeing cloud-based browsing as a way to cut through the clutter.

“We’re looking to turn the problem on its head,” Wallace said. “Rather than adding more boxes, which adds more latency — then the users become more and more frustrated with the performance — we’re looking for a different way to do this.”

While it’s clear that a browser-based approach will not stop all cyberattacks, DISA is playing the odds here. Some 30 to 70 percent of cyberattacks come through the browser, Wallace said. A single solution that short-circuits those incursions would go a long way toward hardening the network. This approach could even help to curtail so-called phishing attacks — scams that come to the user via email.

“Typically, in the phishing attack, it’s embedding a link that sends that user to a given website where they then hit malware,” Wallace said. If such an attack made it through via email, the cloud-based approach would keep it at arm’s length. “That browsing session will launch out in the cloud. That malware will be executed out there and not on the endpoint or within the DoD networks.”

A successful pilot program conducted a year ago led DISA officials to believe in the basic viability of this emerging strategy. “We do know technically that this works,” Wallace said. While he noted the relatively small number of vendors in the space could pose a technical hurdle, others have suggested that DISA’s interest could accelerate the pace of development.

“With over 3 million DoD users, the amount of spending is going to be significant and will drive startups to create innovative new offerings,” said Matt Chiodi, the vice president of cloud security at RedLock. “DoD will literally drive the market to create new tech to meet this demand.”

Brig. Gen. Maria Barrett, deputy of operations J-3 at CYBERCOM, at a June keynote address hosted by AFCEA’s Northern Virginia Chapter announced the development of the draft.

“This included a tabletop exercise with the participants to better understand the friction point when it came to how we might operate in defensive operations together,” she said.

Beginning with the Five Eyes partners made sense given the robust intelligence sharing information the already exists, Lt. Cmdr. Brian Evans, lead strategist and defensive cyber operations planner in the Defense Department Information Network Operations and Defensive Planning Division at CYBERCOM, told C4ISRNET on the sidelines of the Defensive Cyber Operations Symposium in Baltimore, Maryland, on June 15.

“When it comes to the sharing of information with regards to defensive cyberspace operations, the mechanisms are already there,” he said.

In regard to what defense cyber operations would look like between countries, Evans said there are different forms: It could be sharing threat intelligence information where each nation is acting independently but synchronized; it could be one nation supporting another with capability or capacity on another nation’s host networks; it could be integrated operations on a shared environment such as the mission partner environment where multiple nations touch a partner network or piece of terrain.

The goal is to operate together in cyberspace, coordinating and synchronizing to achieve a desired objective.

Such a partnership could be a template for future coalition operations in a multi-domain, multinational campaign across a theater of operations aimed toward a joint objective. However, Evans noted that CYBERCOM — which is still an infant organization — along with other nations have to crawl, walk and then run.

“We’re going to start with the Five Eye partners where that information sharing is the easiest,” he said. “We are much closer in the way that we operate and think, and once we’ve accomplished that, we will look to then: How do we integrate with NATO? how do we integrate with potentially partners outside of NATO for various purposes when required?”

According to Barrett, the hope is to be conducting joint defensive cyber ops in the fall. In the meantime, Evans said the questions surrounding defensive cyber ops with Five Eyes partners remain: How do they do that command and control? What are the capabilities that each country brings to bear? How do they integrate and synchronize those capabilities to maximize their operational advantage?

This intel/ops fusion cell reaches out to the National Security Agency, the Defense Intelligence Agency and other intel agencies, Thomas told C4ISRNET, to bring back information that allows them to look at it from an operational standpoint and fuse that information together to get ahead of the adversary.

This intelligence information enables JFHQ-DoDIN to help prioritize and coordinate resources before a potential incident takes place.

As Lt. Col. Patrick Daniel, who formerly served as deputy director of strategy and plans at JFHQ-DoDIN, explained last year, the difference between DoDIN operations and defensive cyber operations/internal defensive measures (JFHQ-DoDIN’s two mission areas) are that DoDIN operations are executed daily as part of running a network, while DCO-IDM are specific actions taken in response to either intelligence, a threat or an incident.

Intelligence might say that a certain adversary will attempt to exploit a version of software on a web server, indicating forces need to focus more resources toward that portion of the network, he said.

Walker’s predecessor, Arati Prabhakar, last year at the Atlantic Council displayed a picture of a baby holding a toothbrush that a machine identified as a baseball bat. This could have mortal implications if a drone feed misidentifies a rake for an AK-47.

“The best of these systems are statistically better than humans at identifying images. The problem is that when they’re wrong, they are wrong in ways that no human would ever be wrong and I think this is a critically important caution about where and how we would use this generation of artificial intelligence,” Prabhakar said.

The goal of DARPA’s Explainable AI program, Walker said, is to utilize psychologists and others to understand what would make a human comfortable in working with a machine, and what must a human know in regard to how a machine develops an answer so it’s not just answer and probability but rather the methodology laid out.

Walker discussed another program in the works in regard to AI that looks at how a human can trust a machine-learning algorithm and a machine based on AI. What verification process must take place surrounding how a machine develops an answer for a human to trust the machine?

These are critical questions that need to be answered for concepts such as the third offset and man-machine teaming to be realized.