The fund announced Wednesday, dubbed Booz Allen Ventures, will concentrate on bankrolling early-stage firms working on cutting-edge technology, and help them find ways to get those innovations into the field for use.

Brian MacCarthy, vice president of tech scouting and ventures at Booz Allen, said in a Monday interview that the fund plans to invest in four to six firms per year, providing seed money ranging from hundreds of thousands to low millions of dollars.

MacCarthy said there is a growing understanding in the defense world that more must be done to open funding streams for firms working on new capabilities such as artificial intelligence, which could in turn help Booz Allen’s government clients. He pointed to the National Security Commission on Artificial Intelligence’s 2021 final report, which recommended major new investments in AI research and development, as an example of the emerging consensus around this need.

“If we can find these capabilities and technologies, how can we be startup friendly?” MacCarthy said. “How can we be founder friendly and help get these critical technologies into the public sector?”

MacCarthy said the fund will first invest in firms concentrating on four core areas: artificial intelligence and machine learning; cybersecurity; so-called deep technology; and C5ISR, or command, control, communications, computers, cyber, intelligence, surveillance and reconnaissance.

Deep technology includes 5G, or fifth-generation network technology; augmented and virtual reality systems; and human performance technology to improve productivity and competence, MacCarthy explained.

The fund, which could invest in companies working on other technologies in subsequent years, keys off Booz Allen’s 7-year-old technical scouting division, MacCarthy said, which he headed for the last five years. This scouting program gave the company a window into where potential opportunities for considerable growth might be in emerging markets, he added.

But the company also needs to provide capital funding “at digital speed,” he said in the release announcing the effort.

“Booz Allen Ventures allows us to actively bridge the gap between opportunity and capability and accelerate the services-to-solutions transformation,” he added. “As a strategic investor at the intersection of technology and mission, we are uniquely positioned to lead, connect and convene advanced tech solutions to drive change in government, faster than ever before.”

In what MacCarthy described as “trial deals” for this fund, Booz Allen last year invested in AI and machine learning firm Latent AI, and this spring followed up with investments in two more AI companies: Synthetaic and Reveal Technology.

When deciding which companies to fund, Booz Allen Ventures will primarily consider how their capabilities and technologies could benefit Booz Allen’s own R&D processes and technical advancements. Booz Allen will also consider its own clients’ technological needs by identifying customers’ gaps that could be fixed by the startup firms.

While Booz Allen plans to fund early-stage companies, MacCarthy said, it also wants them to have at least some technologies out of the lab and in the field to demonstrate their utility. Technologies that are several years from hitting the field, such as electric vertical-takeoff-and-landing aircraft, are “just too capital intensive and not the right strategic fit for us,” he said.

Booz Allen hopes this will be an evergreen fund, and that revenues generated by the companies it invests in will fund future investments.

“This problem is certainly not going away, in getting critical and emerging technologies to the forefront,” MacCarthy said.

Concerns about cybersecurity threats posed by foreign adversaries were on the rise even before the conflict. According to the 2022 SolarWinds Public Sector Cybersecurity Survey Report, 56% of federal IT operations and security decision-makers state foreign governments are now one of the top security threats, along with the general hacking community and untrained insiders.

To combat these threats, protect American critical infrastructure and safeguard personal information, the federal government is actively seeking to strengthen its cybersecurity workforce. Agencies must find innovative ways to compete with lucrative private sector positions to do so, but it’s a perpetual challenge. In recent years, many federal agencies have seen their pool of cyber talent shrink.

Here are some best practices federal agencies can implement to better attract and retain a federal cybersecurity workforce.

Make a Case for a Rotational Cyber Workforce Program

On June 21, President Joe Biden signed the Federal Rotational Cyber Workforce Program Act into law, offering agencies a practical solution to the cyber staffing crisis—if they act proactively.

Under this new law, the Office of Personnel Management must establish a cross-agency rotational workforce development program allowing employees to work outside a single position within a single public office. The idea is that as cybersecurity professionals move across departments, agencies will benefit from knowledge transfer and collaborative efforts to address advanced threats.

The program could also be used as a recruitment and retention tool. In theory, cybersecurity professionals will gain substantial experience across different departments, enhancing career opportunities and facilitating the expansion of each person’s professional network.

The program will be open to IT, cybersecurity, and cyber-related functions. The OPM will be charged with developing policies, processes, and procedures for detailing employees among rotational positions.

Therefore, it behooves IT and security leaders to make a case for their agencies’ participation and eligibility for the program sooner rather than later.

Address the Soft Skills Gap

Today’s cybersecurity professionals have a broad range of responsibilities. In addition to technical ability, they’re often called on to display nontechnical skills. For instance, they may be required to make a business case for IT investments, resource allocation, and new risk reduction strategies. They must also collaborate and share best practices within the federal government and industry.

Unfortunately, these “soft” or “people” skills are rarely sought or fostered within the federal cybersecurity workforce. As agencies enter a new paradigm of cyber risk, they must do everything they can to address this gap and ensure employees have the soft skills to adapt quickly and easily to the future of cybersecurity and succeed in a federal career. Indeed, strengthening and empowering the high-tech federal workforce is a key goal of the Biden administration’s management agenda.

For instance, strong communication skills are essential to ensuring teams understand the criticality of a project. Each stakeholder must appreciate the technical goals of any cybersecurity initiative and how it relates to the agency’s mission and convey all this in nontechnical terms (i.e., speak “the language of the business”). This is especially important if a project impacts many staffers and cyber professionals are called on to gain broader buy-in from the rest of the agency.

Collaboration is also vital. No agency works in a vacuum, and different groups must work together to share intelligence and accelerate efforts to lock their digital doors.

Adaptability is another crucial soft skill. Change is constant in today’s world, and the pressures on federal cyber pros have been unrelenting over the past few years. After successfully helping the federal government pivot to ensure secure remote work policies, many are hoping for a return to normal. But once again, society is at an inflection point, and there’s no room for overconfidence or security apathy.

The ability to function in this ever-changing environment is becoming increasingly important. Federal cyber pros must be able to shift their thinking quickly and be willing to embrace—and thrive through—change.

Communication, collaboration and adaptability will take on new significance with the recent implementation of the Federal Rotational Cyber Workforce Program Act. As such, IT and security leaders must revisit their job requirements (even for the most technical staffers) and prioritize skills development with strategic training opportunities capable of bringing value to the organization and the workforce—and time is of the essence.

Brandon Shopp is Group Vice President, Product Strategy, at SolarWinds, a supplier of network and systems management software.

The proliferation of fraud is hardly a surprise. In times of great stress and panic, savvy fraudsters descend on vulnerable private sector companies and large-scale government programs where funds seem plentiful. This problem manifested with the recent announcement that an estimated $163 billion in pandemic unemployment benefits was likely lost to fraud and waste, siphoning valuable resources from those that needed it most.

U.S. government agencies have sought to verify and characterize the potential fraud risk of applicants for national COVID-19 grant programs. For example, in one case that analyzed tens of thousands of small business applicants, analytic experts at Dun & Bradstreet and fraud examiners leveraged human-guided artificial intelligence and a certified fraudulent activity repository to identify hundreds of applicants – eligible for millions of dollars in grants – who triggered potential fraud indicators, and other cases where clear-cut malfeasant activity was present.

While the agency was able to ensure funding was going to those most deserving and in the most need, it is unfortunate that these tumultuous times have created opportunities for fraudsters to exploit federal relief programs and citizens who rely on those programs. As the world digitally transforms, tools using data and analytics are getting better at exposing fraudulent activity. By detecting anomalies in data using advanced technologies such as artificial intelligence and machine learning, agencies are able to identify nefarious activity and stop it before more costly and malicious activity occurs. Actionable information extracted from data can also enable agencies to detect and prevent fraud before it happens.

The key to prevention is preparation. Multiple comprehensive strategies for covering a range of contingencies should be developed. Best practices, such as the Five Cs of Fraud Prevention, can be used as a roadmap for analyzing and mitigating risk and ensuring that the key elements of prevention are utilized.

The Five Cs of Fraud Prevention:

• Confirmation: Make sure the company or person truly exists.
• Condition: Check if the company has the hallmarks of a normal, functioning business.
• Consistency: Assess whether the stated facts about the business are consistent with other sources of information.
• Character: Discover whether any past issues could impose risks on the transaction.
• Continuity: Determine whether the company’s operational status has changed and might be posing new risks.

Where do government agencies and contractors begin? It’s important to build a detailed, holistic picture of a company or entity to address multiple indicators of potential risk. For example, by bringing together real-time data and integrating disparate datasets, organizations can better understand key characteristics of a contracting partner, including whether it is foreign owned, the number of employees it supports, the degree of financial stress it is experiencing, and whether its owners and principles are connected to fraudulent companies. Having a holistic data picture of any company also enables investigators to alter their analytics lens as needed to adapt to ever-changing fraud tactics.

While these initial measures are helpful, it is just as important to implement a framework for the continuous monitoring and analyzing of data. Adopting such data-driven approaches aids in the implementation and oversight of timely COVID-19 relief and recovery programs, but also to the many traditional federal programs — from small business assistance, emergency management assistance, block grants, and more — that also need to use data and analytics smartly to ensure their financial programs adequately support the organization’s overarching mission to help our nation’s citizens and communities.

Using more data-driven, diligent practices will help reduce risk, fill information gaps, and ensure more effective evidence-based risk management programs today and in the future. By using data and analysis to build systematic, vigorous, and comprehensive due diligence directly into agencies’ existing controls and information systems, it is possible to stay well ahead of would-be fraudsters.

This level of fraud is a national security issue of such magnitude that President Joe Biden called it out in his State of the Union Address. The race is on to always stay steps ahead of savvy fraudsters and to do that, agencies must have the tools to defend their sensitive information—and the 5Cs are there to guide us.

Have an opinion?

This article is an Op-Ed and as such, the opinions expressed are those of the authors. If you would like to respond, or have an editorial of your own you would like to submit, please email Federal Times Senior Managing Editor Cary O’Reilly.

Want more perspectives like this sent straight to you? Subscribe to get our Commentary & Opinion newsletter once a week.

“As we look at allies and partners and their cybersecurity and the interest of adversaries in undermining, via cyber, our allies and partners in the context of our commitments and our alliances when we are going to fight together, it’s really important that we think about cybersecurity of our allies and partners and that we think about how to bring that up to speed,” Eoyang said at C4ISRNET’s CyberCon on Nov. 10.

“We’re hearing frequently from our allies and partners” across NATO, in Europe and in the Asia Pacific region “requests for assistance in the cybersecurity arena,” she said.

The Defense Department needs to do “a better job” understanding how it can use the Defense Security Cooperation Agency and other mechanisms to help allied and partner nations improve their own cybersecurity, Eoyang added.

To effectively help other nations, she said, the Pentagon will need industry’s help.

“I would argue that some of the best talent is actually in the private sector because we in the department certainly can’t afford to pay what the private sector pays in many of these circumstances,” Eoyang argued.

The Pentagon has begun discussions with DSCA as well as regional commands and Cyber Command about how to work together to improve cybersecurity for allies.

DoD has offered in-house cybersecurity capacity- and skill-building in the past, “but we’re not the only people who can help with that and so doing a better job of understanding what’s available out there in the private sector, how that might fit for ally and partner needs, we have a lot of work to do here, but we are really interested in moving forward,” Eoyang said.

“It’s certainly a conversation we look forward to having with industry to better understand what are the obstacles to doing that? How can we incentivize that,” she said.

Eoyang stressed not all nations are “equally situated to their understanding of the highly capable threat that we’re all up against.”

Strong cybersecurity among allies and partners, Eoyang said, is key because “when you fight as a coalition, you have to plan together, you have to train together and if those activities are compromised via cyber means where the adversary figures out how to get inside our playbook and inside our huddle, that’s a real problem for our ability to fight and win together.”

Meanwhile, Eoyang’s Pentagon cyber policy shop is currently focused on solving problems within two major areas: securing elections and protecting critical infrastructure from ransomware attacks like the one that shut down the Colonial Pipeline in May and led to fuel shortages in several states.

“I think in the past, a lot of people thought of these things just as crime and nuisance and not rising to the level of a national security threat that would involve the Department of Defense,” she said, “but we see the adversaries’ capabilities rise in this area. Ransomware is very clearly a priority for the Department of Defense and we are actively engaged in the whole-of-government efforts to disrupt and impose consequences on those malicious actors.”

That means the U.S. must in turn keep shifting the tools and techniques it uses to counter hackers from nations like China, Russia, Iran and North Korea — and team up with the private sector to do so, David Luber, deputy director for NSA’s cybersecurity directorate, said in a panel during C4ISRNET’s CyberCon.

“Even as we’re on this call right now, the cyberspace domain is changing,” Luber said. “New malware is being released, new vulnerabilities are being discovered, and adversaries will use those vulnerabilities to gain access to our critical … Department of Defense and national security systems.”

As part of its effort to work with the private sector, Luber said NSA’s Cybersecurity Collaboration Center is developing analytics that help it sift through both government signals intelligence collected overseas and what industry analysts have spotted.

“By comparing results, we’re able to better understand the tradecraft of those adversaries, and then develop, jointly, methods to thwart their activities,” Luber said.

The NSA has published more than 50 cybersecurity advisories over the last two years to share threat intelligence with the defense industry and other organizations. Some of those advisories have gone so far as to highlight specific pieces of malware, or tactics, techniques and procedures that Russian or Chinese hackers use to try to get into sensitive networks and infrastructures, and common vulnerabilities they like to exploit.

Hackers from Iran, North Korea or non-state organizations that try to extort money using ransomware are also threats, Luber said.

Rear Adm. Mike Ryan, head of the Coast Guard’s Cyber Command, said during the same panel that while the competition to recruit in-demand cybersecurity professionals is tough, his service’s mission and the enthusiasm it breeds help make it competitive.

“People want to be part of my command,” Ryan said. “I am not going to win on the salary and compensation schemes, but I can definitely be competitive through the selfless service we enjoy from … the incredible opportunities that we allow our people to execute.”

But money never hurts — Ryan noted the Coast Guard is trying to use bonuses to attract talented candidates.

Luber said NSA has partnerships with 340 universities nationwide to encourage students to study cybersecurity. Every summer, he said, about 300 students receive 12-week internships at NSA, and 70% to 85% of those interns go on to work for NSA full-time after graduation.

NSA also is trying to encourage even younger people to consider careers in science, technology, engineering and mathematics through a program called GenCyber, which offers students from kindergarten through high school opportunities to attend summer camps focused on cybersecurity. This past summer, he said, GenCyber offered 146 camps in 46 states, Washington, DC, and Puerto Rico.

“It begins early with partnerships — partnerships at K through 12, partnerships with universities, the professors, the students and the faculty — to build the next generation of cybersecurity experts to bring their talents to the National Security Agency,” Luber said.

David McKeown, DoD’s chief information security officer, said the office will fall under DoD’s chief information officer and be led by a yet-to-be-named senior executive. The move is part of an acceleration to ongoing zero trust implementation spurred by the Russian-orchestrated SolarWinds intrusion of federal systems.

“We’ve redoubled our efforts, we’ve fought for dollars internally to get after this problem faster,” McKeown said at C4ISRNET’s CyberCon event. “We’re standing up a portfolio management office that will … rationalize all network environments out there, prioritize and set each one of them on a path of zero trust over the coming five, six, seven years.”

Zero trust assumes no trust across networks, devices or users, and demands constant, real-time authentication of the users accessing data. It’s a departure from perimeter-based security, through which an intruder can often move freely through a network after penetrating it.

McKeown said that while DoD has adopted some components that are meant to work together to create a “zero trust” environment, it’s not being prescriptive about the products its enclaves choose to adopt, as long as those products work together.

“We’ve got a lot of attention on this now, and we’ve got senior leadership in the department on board and putting their money where their mouth is and helping us to implement this at a very fast pace,” he said.

His comments come nearly six months after the Biden administration’s cybersecurity order to improve protections at government agencies in the wake of the SolarWinds intrusion.

McKeown said the sophisticated attack demonstrates the lengths to which intruders will go and the need for better security. SolarWinds, he noted, was a widely trusted piece of software that nonetheless began “beaconing out” from within networks.

“We have to be able to detect something like that,” McKeown said. “Not only the external compromises but the internal malicious behavior and potential supply chain risks need to be looked at.”

“We feel like zero trust is the only solution out there right now that gives us a fighting chance on detecting these folks that may have a foothold on our network or this anomalous software that we’ve allowed in.”

Right now, the DoD is working on developing personnel into expert level coders, but that’s not an easily scalable solution, according to Col. William Waynick, director of the Air Force’s CyberWorx program, an Air Force office that works with industry and academia to deliver new tools to meet user needs. Hence, the pilot program, called the “Other Airmen,” which aims to get airmen just the basic skills they need to get a job done.

“So we’re looking at technology out there that will allow anybody with minimal training to develop applications that they need,” Waynick said at C4ISRNET’s CyberCon virtual event. “Now, they probably want to go into the complex applications like they would have software houses. But we do believe that a majority of applications out there that the users need can actually be taken care of by low-code, no-code.”

Waynick said the team currently has 20 people from across the Air Force and Army working with five vendors on the project. The teams are currently working on applications for equipment tracking, and readiness and training trackers. Another team is working on a contracting pilot to make it easier for industry to submit pitches to acquisition professionals.

“They’re interested in making an application for pitch decks from industry,” Waynick said. “So industry can, instead of just sending a white paper to an acquisition office, they can actually send the entire pitch. And so that way, they have video, and they can do maybe some Q and A’s maybe live, but they’re making an application to to provide a capability for industry to provide pitches as well.”

The airmen and soldiers working on the project participate on the side of their normal jobs, including piloting, logistics or finance. In March, Waynick said that the team will brief Lt. Gen. Timothy Haugh, commander of the 16th Air Force, on the results of the pilot.

CyberWorx is centered on delivering tool the user can actually us, not focusing on the technology for technology’s sake, Waynick said. Airmen have an abundance of tools to choose from, he said, but the tools don’t always do what the airmen need them to do.

“The issue that I’ve seen, and I’m seeing still, is that there are too many tools. And I would just say, you know, each has a specific function,” Waynick said. “But not everything that the user needs so they have to go to another tool. And a lot of the times these tools aren’t exactly what the user needs.”

Speaking at the C4ISRNET CyberCon event, Maj. Gen. Maria Barrett, commanding general of the Army’s Network Enterprise Technology Command, said the capability was nearly ready to be put into production, where it will be distributed to about 2,000 users.

The pilot program included 500 people. It used commercial solutions to access sensitive data and classified data up to the secret level. In June, Barrett told C4ISRNET the “majority” of devices accessing sensitive or secret information would be virtual desktops with no data storage on the end user device, while others would store data to allow for users to work offine.

Under the program, users can access both the Non-classified Internet Protocol (IP) Router Network and the Secret Internet Protocol Router Network on the same laptop.

“I can take it on a trip, I fire it up and I have full desktop functionality …. I can do video teleconferencing, I can go to portals. So it’s not just email,” Barrett said.

She said that the service has “advertised” the new classified capability out to “a number” of Army components, particularly ones that have requested DoD Mobility Classified Capability (DMCC) devices from the Defense Information Systems Agency. That tool allows limited classified abilities, but not to the same extent for Barrett’s use case.

“For any Army element that has requested these [DMCC] devices from DISA, we’re looking at that list and saying could this substitute for DMCC requests that you put in so that the DMCC’s can go back into the pool available to the rest of DoD,” Barrett said.

In the future, she said, she would like to move the Army away from maintaining its own infrastructure to enable the capability.

“Ideally in the future, I’d love to see a CSfC solution that leverages Impact Level-Six cloud and that would unencumber us from having to stand up and maintain our own infrastructure,” Barrett said, referring to the DoD cloud certification level that allows for secret data storage.

Meanwhile, the Department of the Navy’s chief information security officer recently took notice of the classified capability that the Army’s NETCOM was rolling out. Chris Cleary, the Navy’s chief information security officer, said he was recently briefed on the Army classified telework program and is trying to move it higher up the Navy’s list of priorities.

Classified telework “was seen as a little lower on our priority stack until we [saw] that. Wow, maybe there is an easier way to do this. And somebody already thought through all the heavy lifting, i.e. the Army initiative,” Cleary said. “I’m already running this up the stack to see what the Navy’s interest or would this drive classified telework capability to a little higher on the priority list.”

From Cleary’s view, classified telework is safer and more convenient as the DoD operates in a pandemic.

“Anybody who had to do … work on a high side machine still had to go into the building for the most part,” Cleary said. “I might have a message that says somebody’s got to do something and then I’ve got to send one of my employees into the Pentagon so they can go do work. Well, is that the right thing to do? Should I put that employee at risk to go back and do the hot zone just to do something on a classified environment?”

“If you wait two or three years before you can take action, it loses its effectiveness,” Langevin said at the event hosted by C4ISRNET. “The message needs to move quickly if you want it to be heard.”

The Democrat from Rhode Island serves as the chairman of the Subcommittee on Intelligence and Emerging Threats and Capabilities, and he is a commissioner on the Cyberspace Solarium Commission.

The commission, a bipartisan organization created by Congress in 2019 to develop a multipronged U.S. cyber strategy, adopted the approach of “layered deterrence.” The first layer seeks to shape behavior, calling for America to work with other nations to promote responsible behavior in cyberspace.

Langevin explained that speedy naming and shaming hasn’t been standard because attribution has proved difficult. However, nations, including the United States, have gotten better and more detailed at attributing action.

But going forward, Langevin said, nations should be more willing to go public with less confident attribution. He said nations have resources at their disposal beyond cyber forensics, such as signals and human intelligence, to aid in attributing a particular cyber incident.

As an example of this approach, Langevin cited the quick attribution to Russia for the poisoning of Sergei Skripal, a former Russian military officer and double agent, in the United Kingdom.

“We didn’t have perfect intelligence there, but countries were able to connect enough of the dots, had high enough confidence that you went from chemical weapons attack to major international response over the course of just a couple of weeks,” he said. “That’s what I’m talking about in terms of dealing with agility in moving decisively.”

Langevin also addressed what he’d like to see from a Joe Biden administration, should the Democratic contender win the presidential election Nov. 3. First and foremost, he’d like to see a potential Biden administration give greater attention to cyberthreats facing the nation.

“I really also hope that a Biden administration will leverage the State Department and [be] more forward-leaning [in] working with our international partners and allies in establishing rules of the road,” he said. “Beyond that, I also hope that a new bureau of cyberspace security and emerging technologies headed by an assistant secretary at the State Department will be created.”

He’d also like to see more pressure on nations like Russia that continue to achieve “wins,” as he put it, on the international stage. As examples, he pointed to Russia’s push for a cyber treaty and its creation of the Open-ended Working Group at the United Nations, which rivals the Group of Governmental Experts that was established in 2019 and sought to develop global norms for cyberspace.

Some actions by the Trump administration, such as removing the cyber coordinator position on the National Security Council and demoting the coordinator for cyber issues at the State Department, “hinders our ability to influence international conversations that have suffered as a result,” he said.

According to John Sherman, the principal deputy chief information officer at the Pentagon, the DoD CIO office expects the Commercial Virtual Remote Environment to be used through next June as the COVID-19 pandemic continues to plague the United States.

The CVR platform, a Microsoft Teams platform that allows for unclassified collaboration between DoD employees, has over 1 million employees across the enterprise. It’s a platform that the DoD has long touted as a major success of ensuring that the department remains productive during the pandemic.

The DoD team is working on developing an “enduring solution” that would enable telework after personnel begin returning to the office. Right now, the CIO’s office is working to establish a new CVR environment with an upgraded security level up to Impact Level Five, which will enable DoD users to work on mission-critical information. The current environment is certified at an Impact Level two, which allows users to work on noncritical mission information from home.

“We know we need a more enduring solution but [one] that keeps the same functionality of CVR, which allows us to talk to people at IL-2, talk to people not on the Department of Defense Information Network,” Sherman said at C4ISRNET’s CyberCon event Oct. 28.

The department began using CVR in March. Top IT leaders boast that the platform was rolled out rapidly, though it was initially expected to be a temporary solution. At one point, the DoD added 250,000 new users in one day. The next iteration of that collaboration platform, Sherman said, will also retain the “bring your own approved device” capability that the CVR platform currently has.

The department’s shift in telework was boosted in part by $300 million allocated by Congress as part of a massive coronavirus relief package.

The services also had to make major investments to prepare for telework. The Army expanded its network capacity by 400 percent; the Air Force increased its virtual private network infrastructure from 10,000 users to 400,000 users; and the Navy increased remote network access for up to 500,000 users.

Sherman also highlighted how the CVR environment allowed the National Guard help respond to the pandemic, adding that the unclassified environment “is exactly what they needed to be able to help set up the field hospitals, help work on some of the medical supply chain issues.”