The reorganization will divide the current undersecretariat for acquisition, technology and logistics, or AT&L, into two new undersecretariats: research and engineering, or R&E, to serve as the chief technology officer; and acquisition and sustainment, or A&S, to serve as the chief acquisition officer.

R&E will set the technology agenda for the DoD, focusing on maintaining and extending U.S. forces’ technological advantage over potential adversaries. A&S will oversee the acquisitions process, focusing on program cost and schedule performance. Crucially, A&S will retain responsibility for logistics policy, enabling the organization to take a holistic view of the cost of a system over its entire life cycle. However, A&S will have a lesser role in direct oversight of acquisitions that AT&L has had in the past, due to the 2016 NDAA’s devolution of significant acquisition authority to the armed services.

Congress intends for these two organizations to have distinct institutional cultures. By design, R&E will adopt a risk-taking culture and A&S will operate with a much lower risk profile. R&E will be allowed to fail, an extreme rarity in the Department of Defense. But for R&E to pursue innovative approaches and advanced technologies, the department must accept that not all ventures succeed. Alternatively, A&S will seek to drive down risk in full-rate production programs to the absolute minimum, so that programs deliver on cost and schedule and perform as intended. These conflicting cultures are intended to create a healthy tension in the department that will result in a more optimal risk posture.

There is a lot of goodness in this reorganization plan. Splitting the current AT&L organization will facilitate creation of the two distinct institutional cultures described above. It will also enable the department to recruit talent specific to either the R&E or A&S portfolio, which require very different skill sets. On the whole, the reorganization has a good chance of succeeding in its goal to elevate the pursuit of advanced technologies while sustaining emphasis on cost, schedule and performance of full-rate production acquisition programs.

However, there is at least one potential pitfall. The planned AT&L split will place oversight responsibility for development of advanced technologies and procurement of those technologies in separate organizations. Doing so could compound the existing challenges of turning a promising technology into a full-rate production program, colloquially known as the Valley of Death.

Several factors conspire to create the Valley of Death. For example, let’s say the department has identified a new technology and everyone agrees it is a worthy investment. Even under these circumstances, it can take years just to secure the funding required to turn an idea or even a prototype into a production program. In the current tight fiscal environment, funding new programs means cutting existing programs, which is always bureaucratically challenging. And with new start programs as rare as they are, due to both fiscal constraints and seemly endless continuing resolutions, the DoD is very reluctant to take a risk on a new idea.

Under the current AT&L organization, the undersecretary oversees both the technology development and acquisition portfolios. As a result, she is positioned to know what is coming down the pipeline, plan accordingly and advocate early in the budget process for a new and promising technology. Splitting AT&L into R&E and A&S increases the chasm between technology development and production by dividing these responsibilities between two separate undersecretariats, making it more difficult for DoD leadership to shepherd projects through this Valley of Death.

There are a couple different ways the department could guard against this outcome. For example, both the department and Congress are exploring middle-tier acquisition approaches. These approaches leverage technology demonstrations and prototypes to drive down technical risk before entering full-rate production using tools like Other Transaction Authority. Doing so helps bridge the gap between a promising technology and a full-rate production program by maturing technology and developing initial concepts of operation before committing to a major acquisition program.

The deputy secretary of defense could also step into the void that the AT&L split may create by ensuring that R&E and A&S remain integrated and focused on turning new technologies into mature procurement programs. Doing so is essential to meeting the goal of the reorganization: maintaining and extending U.S. forces’ technological advantage in the face of increasing competition.

Susanna V. Blume is a fellow in the Defense Strategies and Assessments program at the Center for a New American Security.

“In general, the CSIRC prevented, detected, reported and responded to cybersecurity incidents,” the audit concluded. For example, out of a sample 100 incidents from a total of 368 incidents in FY 2015 and 2016, the CSIRC “properly identified and documented the type, nature and scope of all 100 incidents with information such as the systems and applications affected, the source of the incident, and the specific kind of lost equipment.”

Nonetheless, the IG audit also found that “not all incidents were properly reported, some supporting incident documentation was insufficient, incident costs were not captured, and reporting procedures were inconsistently applied.”

Auditors recommended that employees and contractors be properly trained in cybersecurity, and that contractors without proper security training be denied access to IRS systems.

The 48-year-old Springfield, Illinois, man pleaded guilty in July to “seeking and receiving bribes” and faces sentencing in federal court on Nov. 30, according to a news release from the U.S. Department of Justice.

Mark Miller worked for the Corps from 2005 until 2015.

He admitted that on Dec. 10, 2009, the Corps awarded a $2.9 million contract to an Afghan construction company that was later increased to $8.1 million. Miller was in Afghanistan from 2009 to 2012 to monitor the road construction project that went from eastern Afghanistan to the Pakistani border.

Miller’s job was to oversee the contract and verify the company performed the work and authorize payments to the company from the Army Corps.

He admitted that he solicited $280,000 in bribes from the company owners to assist with the project and ensure it was not terminated. He also received $40,000 in bribes after the contract ended for the “possibility of future contract work and other benefits.”

The case was investigated by the FBI, the U.S. Army Criminal Investigation Command and the Defense Criminal Investigative Service and prosecuted by the Justice Department’s criminal division office in central Illinois.

With the Trump administration’s focus on upgrading federal agencies’ information technology and overhauling its organization, shared services is seen as the vehicle to help accomplish both goals, putting USSM in the driver’s seat.

With she and her team tapped as finalists for the Samuel J. Heyman Service to America Medals, Angerman talks to Senior Staff Reporter Carten Cordell about USSM’s path and the future of shared services.

You and the Unified Shared Services Management Team were recently nominated for a Samuel J. Heyman Service to America Medal. Talk about how the new administration has embraced shared services as a solution?

The Trump administration has sent so many important signals that running an efficient government is really important, and shared services has become one of what I think is a series of different tools in a toolbox that really could achieve those outcomes.

Can you talk about what the process of standing up USSM from 2015 to now has been like?

We’re still working really closely with the federal agencies to understand: what are the real opportunities for shared services? There’s a lot that’s common across government today. I think it’s important that we identify the right priorities, the low-hanging fruit, if you will, where we actually see the most demand and where are the pain points of agencies today so that we can start to show the value of shared services in a new way that will only build more demand as time goes on. And build the confidence that shared services can actually work in the federal government in a new model going forward.

Have the developments of both agency reorganization and IT modernization put a brighter spotlight on the potential of shared services?

Focusing on IT is a really critical first step in helping us leverage the great benefits of technology today. Traditionally, the government has been in this business of buying software and then installing it somewhere in our agency and then customizing it. And then five years later, we’re faced with the cost and the burden to be able to maintain it and keep it relevant and keep it secure and keep it updated. And that cycle has become one that’s not sustainable going forward.

We also have a challenge today with shared services that current agencies who offer a solution to other agencies are very wed to their system and the way that they offered that service, so buying the service is dependent on also buying the technology. And if the technology is already a legacy technology, we’re not actually fixing a problem or perpetuating history.

We want to leapfrog over the way that we do it today and move to a model where we can actually buy that technology as a service from industry. We put that stake in the ground and we say, ‘We believe there isn’t enough common about what we do in government similar to the way that Fortune 500 companies run their business, but let’s leverage that IT to get real scale for the government so that we can provide services on any modern IT platform. So that we can lean on companies whose mission it is and whose business it is to do the work of keeping that system modern, so I don’t have to worry anymore about security patches and upgrades and legislative requirements because someone else is doing all that for me.’

I fundamentally think that there is no agency in this government whose mission it really is to make sure that our finance systems are secure. And I think this is a great opportunity for us to free ourselves from that legacy technology, to leverage commercial technology and really double down on the services that do make us uniquely government.

Can you talk about USSM’s current initiatives — like Data Driven Performance Management and the M3 Framework — and what you are working on for 2018?

We’ve successfully run our second year of a data collection effort of the current shared service providers so that we can understand more about the current ecosystem of shared service providers, where customer pain points are with those current solutions and services and where honestly provider pain points are.

Shared services has been a successful strategy in the private sector for some time. How does that process scale to government?

It’s very difficult to be a shared service provider in government, because the first problem is we don’t actually have access to capital in government like they do when you’re running a system or a service in a private company. So that alone is actually a real inhibitor to being able to keep our IT modern and continue to evolve what services that providers offer today.

So there’s a whole series of challenges that exist in our current marketplace that now we have some insight into that we never had before because we’ve successfully collected data, both in performance, but also in customer satisfaction of the current shared service model. That data has been a really important source for helping the new administration figure out what the future of shared services may look like.

And we’re looking forward to — hopefully in the next upcoming months — [what] will be very telling as to just what stamp for this administration puts on the future of shared services.

When USSM was established, it received a lot of praise for the potential and efficiency it could bring to the federal government. Do you look back at the scope of what USSM has achieved so far since its inception and measure how far it has come?

Not yet, because I think there’s still so much more work to be done. I’m very personally motivated by the mission of our office.

I think about how the government has 108 time and attendance systems today. We spend more money running learning administration systems, $1.2 billion dollars just running systems that allow us to sign up for training.

And I think that that’s a really important mission that we have to make that work be more efficient. To stop allowing customizations, to stop allowing differences where differences aren’t truly driven by a regulation or law so that we can actually add more value to taxpayers.

We have a taxpayer dollar and we have a really important job in government to figure out how that dollar spent. And do we want it to go to having 108 different time and attendance systems or do you want to create more opportunity? I think about my other Sammy finalists and some of the amazing work that they’ve been able to do.

What I kind of see is what the work that we do in USSM is creating more resources — whether it’s human resources or financial resources — to do more of the work that those other finalists do that is really driving the value back to the taxpayer.

And so yeah it’s a hard time because we’re seeing across government the message of the hiring freeze, reduction of resources, reduction of budget. So I think we actually have, within our control in government today, the opportunity to make some really important decisions about how government will run in the future so that we can maximize our value to the taxpayer.

As PBS commissioner, Matthews will manage 370 million rentable square feet in more than 8,600 active assets across the country and oversee the disposal and acquisition of real estate to provide the GSA’s partners with space needed to accomplish their goals, according to a press release.

Matthews replaces Norman Dong, who stepped down in March 2017 to join the private sector.

Matthews has served for more than 20 years with the House of Representatives and, for the past 14, he has served as the Republican staff director for the House Transportation and Infrastructure Committee’s Subcommittee on Economic Development, Public Buildings and Emergency Management.

GSA Acting Administrator Timothy Horne thinks Matthews will be an unique and invaluable asset to the PBS. In the news release, he said Matthews “has a tremendous appreciation for the value PBS delivers and we look forward to benefiting from his leadership experience and expert insight,” and he looks forward to working with Matthews.

After Matthews is sworn in to his new position on Aug. 3, Michael Gerber, who has been serving as the acting PBS commissioner, will return to his previous role as deputy PBS commissioner.

Led by Committee on Homeland Security Ranking Member Bennie Thompson, D-Miss., and Committee on House Administration Ranking Member Robert Brady, D-Pa., the task force will also include Reps. Zoe Lofgren, D-Ca., Cedric Richmond, D-La., Val Demings, D-Fla., and Jim Langevin, D-RI.

Reps. Thompson and Brady commented on the membership of the committee in a news release, saying that the security of election systems should not be a partisan issue, but a top priority for everyone. If nothing is done, “we make it easy for Russia — or anyone else — to meddle in our elections and undermine public confidence in democratic institutions.”

“I believe that the Task Force has an important role to play in examining the threat to elections, including to auxiliary systems such as those used for vote tallying, and examining solutions like risk limiting audits to protect their integrity,” said Rep. Langevin, co-founder and co-chair of the Congressional Cybersecurity Caucus, in the same press release.

The committee is “eager to work together” on the protection of election systems in order to prevent a repeat of the 2016 presidential election. The membership of the task force has been established, but they continue to “welcome the support of members on both sides of the aisle.”

Few governments have an obligation to report data breach incidents, but an assessment of 2016 incidents ranks the public administration sector as the ninth most-targeted sector. 

Cyber espionage is nothing new, but cheaper and better ways to create chaos or unravel government and critical structures increase the likelihood of data and phishing, spoofing, or social engineering tactics. Nearly 1.2 million government identities were exposed in 2016, and the frequency and vectors of attack are increasing.

The average rate of spam fell from 2015 to 2016 — data consistent with general trends seen throughout industry sectors. However, the decreased interest in spam is balanced by an increased interest in utilizing phishing scams. The overall average use of phishing scams seen in the public administration sector grew from 1 out of every 3,058 emails in 2015 to 1 out of every 2,329 emails in 2016. In addition, the use of malware rose significantly. In 2015, malware was averaged at 1 out of every 526 emails; last year, however, the average use of malware was 1 out of every 141 emails.

Of all the attacks in 2016, most against government sectors originated from within the United States or from India. The cybercriminal’s most popular method of attack were web server attacks, which accounted for 35.6 percent of all attacks on the government. At a close second, shellcode/exploit attacks accounted for 31.5 percent of government and critical infrastructure attacks, most of which were see within the healthcare sector of the government.

The proliferation of Internet of Things devices and systems nearing the end of their lifecycle means components need to be designed not only to fit a purpose, but to be secure for use from deployment. Collaboration with industry can assist transparency in the security of devices and decisions on how to design and integrate products for government networks. It can also assist the design of training programs that can greatly assist data loss prevention. 

The evolved trends and techniques make use of resources at hand. By “living off the land” cybercriminals can enact a symptomless infection and hide in plain sight. Knowing the current trends and security risks is essential for government security teams to make a more secure network.

A complete copy of the 106-page report will become available on Symantec’s site.