Agility Loop

Cloud computing is one of those buzz words that gets thrown around so haphazardly. Like cyber, and now smart data or linked data, it is typically used as a way to get money. 

(Quick aside.  Someone should put together a case study of what Booz Allen Hamiliton did as the cyber hysteria was ramping up.  They both fanned the flames AND came up with solutions.  You can say what you want about the process, but it seems to have worked)

The problem is that I read definitions of cloud that are either incorrect or all-inclusive.  As an example:

Cloud (computing) strategy involves a way to access applications hosted on the web through a user's browser...

Although many cloud apps are web based, there are plenty of traditional "thick" or phone apps that use the cloud too.  Hell, your gaming console uses the cloud!

It is rare that something gets published in mainstream media about leadership and corporations that I identify with so completely.

Bravo Eric Jackson and Forbes.

Through LinkedIn Today, I found a story on Forbes website entitled Top Ten Reasons Why Large Companies Fail To Keep Their Best Talent.  It lists Jackson's list of ten reasons of why companies lose their best talent. 

All ten reasons ring true to me, but several really resonate with me.  For example #2, "Failing to Find a Project for the Talent that Ignites Their Passion":

Big companies have many moving parts — by definition. Therefore, they usually don’t have people going around to their best and brightest asking them if they’re enjoying their current projects or if they want to work on something new that they’re really interested in which would help the company. HR people are usually too busy keeping up with other things to get into this. The bosses are also usually tapped out on time and this becomes a “nice to have” rather than “must have” conversation. However, unless you see it as a “must have,” say adios to some of your best people. Top talent isn’t driven by money and power, but by the opportunity to be a part of something huge, that will change the world, and for which they are really passionate. Big companies usually never spend the time to figure this out with those people.

I do understand that in the corporate world, especially the consulting/contracting world, the priority is to really keep an individual is muted by the drive to fill jobs and win new work.  However, I think that many in my generation really want to find value in their work.  Being a simple seat filler is not enough...you need show me more.  Make an employee CARE for their work, and you will get amazing results.

And then there was #8, "The Missing Vision Thing".  Likely the biggest reason I will be considering other opportunities starting in the New Year.

This might sound obvious, but is the future of your organization exciting? What strategy are you executing? What is the vision you want this talented person to fulfill? Did they have a say/input into this vision? If the answer is no, there’s work to do — and fast. 8. The Missing Vision Thing. This might sound obvious, but is the future of your organization exciting? What strategy are you executing? What is the vision you want this talented person to fulfill? Did they have a say/input into this vision? If the answer is no, there’s work to do — and fast.

Many of these tenets also apply to the success of government organizations as well.  Too often talented people are seen as simple cogs...easy to replace with the next person with the same resume.  It might even be worse since government is also not rewarded based off results, just awarded for maintaining their huge pot of money or inflating their egos.

So take a moment to read the article...worth the time.

Registration is now open for Workshop on Information Sharing and Safeguarding Standards (WIS3), AKA Standards-Palooza, on December 5th in Washington DC!  The intent of the event is bring together government and industry to discuss how standards based innovation can advance information sharing. 

Although the event is organized by the Office of the Program Manager for the Information Sharing Environment (PM-ISE), industry organizations AFEI, IJIS, ACT-IAC, and OMG are actively participating by leading breakout tracks on specific topics. The topics include:

• OMG: Translation of Business Requirements to Technical Architectures
  Translating business requirements to technical architectures to automate information sharing
• AFEI: Identity and Access Management Across Government
  Authenticating and authorizing ISE users to access information sharing systems data
• IJIS: Federated Information Sharing Frameworks and Services
  Messaging frameworks and services that can operate across agencies
• ACT-IAC: Supporting Standardized Information Exchanges Across Government
  Standardized information exchange models that enable interoperable information sharing

The hope is that this event is actually a kickoff for a set of other intiatives to advance the ISE, so stay tuned to the ISE website for more information.

Excited to be moderating a panel next Tuesday November 8th at the FOSE Enterprise Management Conference & Exposition entitled "EA and Information Sharing - From Intelligence to Assets".  I will be joined by Emile Beshai from DHS, Glenn Cruickshank from Deloitte Consulting, and Sue Jaxel from the Office of the Director of National Intelligence. 

The high level description of the session:

Information sharing is at the heart of every agency’s mission – whether it’s in the areas of healthcare, citizen services, or national security.  This panel will include two case-studies detailing how agencies within the intelligence and national security communities leveraged enterprise architecture to achieve real-time information sharing not only within the federal government, but across all internal and external domains.  The first case-study will delve into the Department of Homeland Security’s SBU Portal Consolidation, which strengthened collaboration and information exchange with key partners in the federal, state, local, tribal, territorial, international, and private sectors.  The second case-study will showcase the IC Enterprise Registry and Repository, an intelligence community enterprise capability that provides IT publishing, IT lifecycle management, and human discovery and retrieval to support the sharing of community assets. 

Looking forward to a thoughtful and engaging discussion!

In my role in supporting the U.S. Government in the evolution of an Information Sharing Environment, I have had the opportunity to become more exposed to the machine that is Enterprise Architecture Frameworks.  Not the frameworks themselves necessarily, but the machine and engine around them.  And more and more I have to wonder, what is the true value of the frameworks and the associated artifacts it produces?

To give context, it is probably useful to understand my background.  I have "grown up" during my professional career architecting (little "a"), designing, and implementing information systems.  This has included upgrades of email infrastructures (I still hate you Groupwise) to enterprise wide white pages/attribute services.  However, when I say that I have architected these systems, I mean that I have worked with some VERY good people to actually plan the entire system from software to hardware to networks to user experiences.  However, during that time, the maintenance and creation of artifacts related to Enterprise Architecture (big "A") Frameworks was NEVER a priority.  Typically there was only enough time and money to actually design and implement the system (DO SOMETHING) rather than the creation of artifacts (PROCESS).

Now does that mean I was simply blind to the usefulness of those frameworks?  Perhaps.  But since then I have had more exposure to life in the SETA world and with agency CIOs where these same Enterprise Architectures get a lot more play.  A lot of money gets spent on maintaining the associated artifacts b/c they are required for certain programs (typically over a certain dollar amount).  There are relatively few people who are "certified" in Enterprise Architecture, and therefore those contractors are pricey. Anyhow, I don't have a good answer.  But I do know that creating documents simply for the sake of creating them is not best practice.  I think there seems to be a lot more value in concentrating on information architectures and knowing more about our data so we can effectively share it with our business partners.

I know there are other tools out there to find out what has been interesting on the web over the last week.  However, the overwhelming flow of information on Google Buzz and Twitter sometimes makes it difficult to keep up.  So, I am going to start a weekly post that will highlight some interesting articles from the web, mostly the blogosphere, in relation to security, cyber, and government contracting.  Don’t be surprised though if I sneak in a couple of goofy links from time to time.

Bill Puts Contractors Out of Work - NextGov There a ton of articles that document the government’s efforts to trim down the contractor workforce.  This particular article focuses in on how the beltway bandit establishment are fighting against change that may effect their wallets.

Understanding and Selecting a Tokenization Solution: Introduction - Securosis Blog An in-depth introduction to tokenization in enterprise applications.  I actually stumbled upon this blog a couple of weeks ago and it is well worth following.  They cover a variety of security topics including log management, network data flow, and secure application development.

Paying for Classified Security - NextGov An article that details the $$$s spent by the federal government on information security.  Ironically enough the costs were actually down between 2008 and 2009, although the number is still at $4.26 billion dollars...not including what the intelligence community spends.

Nightwatch This less about an article and more about Nightwatch overall.  Great feed to follow to read in-depth goings on in the rest of the world.  Most updates feature editor commentary that give greater insight into situation such as the North Korean/South Korean submarine debacle.

Cryptography Success Story - Schneier on Security A link to an article showcasing where encryption of a hard drive actually foiled both Brazilian authorities and the FBI.  Certainly a good thing from a protection perspecitve, but maybe not so good from an inteligence collecting angle.  The comments on Schneier’s blogs are always insightful (and entertaining) as well.

In today's post, Jack Goldsmith and Melissa Hathaway contributed an article entitled "The cybersecurity changes we need".  The authors criticize the current administration in their approach to cybersecurity and state that it is focusing on short term gains rather than the long term. I have become a little exasperated by all of the sword rattling and cheesy commercials using the public's fear of "taking down the power grid".   I had hope for the article when it started:

The news is filled with scary stories about the insecurity of the computer and telecommunication systems on which our nation's prosperity depends: malicious software planted in electricity-grid computers; rampant state-sponsored and criminal cyber-espionage and theft; and the possibility of cyberattacks on banking and transportation systems.

However, rather than make suggestions on what should be done, they take the rest of the article to criticize the administration for paying lip service  to cybersecurity and policies that have been established.  I don't necessarily disagree with that thought, but I also think it is always more useful for all if a plan, even a high level one, is proposed.  Cybersecurity (or insecurity) is DEFINITELY a threat as we all become increasingly "plugged in".  BUT, like most topics that have billions associated with it, they hype can become quickly overblown into fears that the Chinese are hacking into the power grid on a regular basis.  A plan is all well and good, but a lack of high level influence within the administration has been a deterrent to actually getting things done.  The establishment of a cyber command, although somewhat scary due to its ties to the NSA, is a good first step.  One thing that I have learned while working in the military is that when shit hits the fan, it actually gets done.

Saw this article over at NextGov this morning stating that the Army wants to outsource the creation of one email service for the Army.  BUT, once you read this article it becomes clear that they actually mean one Exchange based email system for the entire Army. The Army has wanted to do this for years, and in some ways had it with an antiquated email system in AKO.  I just wonder if other vendors out there will argue that there systems should be up to the task?  Seems like the Army has already made the decision on vendor without a fair competition...or at least that is an easy argument for  a vendor. What's also interesting is that the Army is "inviting companies to partner with the Defense Information Systems Agency" to house the email system.  Not sure how that contractual relationship would even work?  DISA's DECCs are not typically vendor facing, and unless something is changed, I am not sure they are designed to work directly with industry.  When working on other enterprise level acquisitions, this same kind of thing was encouraged, and the only offers that were really considered were those that housed the system at DISA "inside the firewall".

The Washington Post reported over the weekend that yet another cybersecurity official has resigned.  This follows the news of the pending resignation of the lead White House cybersecurity official Melissa Hathaway.  Ms. Hathaway's quote from the Post article:

"I wasn't willing to continue to wait any longer, because I'm not empowered right now to continue to drive the change," she said. "I've concluded that I can do more now from a different role," most likely in the private sector.

I think both of these resignations, as well as others, underscores the challenge that the U.S. Government is in trying to keep up in the technology sector...hiring people.  From reading the article, it is fairly clear that Ms. Hathaway's resignation was a fueled by an inability to work in the system and get the right people hired.  DoD and other agencies desperately need talented, smart people to lead cybersecurity efforts.  However, from personal experience it is a very difficult sell. From a contractor perspective, I see the folks who are hard working and attempting to be progressive in government.  It is HARD.  And many times, I think that more can be done from the contractor side simply b/c it is MUCH easier to build an effective team around a hard working and progressive leader.  The government's hiring practices make it very difficult to compete with private industry.  It can sometimes take months to hire someone into the government.  How long does it take a beltway bandit to do the same?  It is measured in days or weeks instead. Somehow the government needs to come up with a good way of attracting talented engineers to help run their programs.  Otherwise, our cybersecurity stance will continue to fall behind and beltway bandits will continue to take advantage of programs like FCS and NCES. UPDATE: Looks like Mischel Kwon, the person who resigned, is joining RSA/EMC.

This is a somewhat refreshing approach.  Rather than ban social networking services altogether like the Marines, the British military has decided to encourage their troops to Tweet or post on Facebook their experiences in the military.  This past week the MOD issued a 13 page document outlining the guidelines for using these services.  Granted, the document has a bit of a CYA tone for the higher ups, but at least it addresses the issue head on rather than bury its head in the sand like some organizations.  Instead you have the Marines who have banned it outright, but the Joint Chiefs of Staff still tweets and has said he will continue to do so. Of course DoD has kicked off a study to determine the vulnerabilities of technologies like Facebook and Twitter.  Wish I got that cherry contract. My thoughts on this issue are fairly simple.  If you simply prohibit an effective way for people to communicate, they will find another way to do it, and it will NOT be on your terms.  Instead users will find a workaround that is probably less secure. and may even expose your data and network more.