This briefing covers active market intelligence, regulatory guidelines, and tactical capture recommendations for federal and defense contractors pursuing opportunities in this procurement classification.
Joe Jarzombek was the former Director for Software and Supply Chain Assurance at the U.S. Department of Homeland Security, and former Deputy Director for Information Assurance at the U.S. Department of Defense. He is currently Global Manager for Software Supply Chain Solutions at the Synopsys Software Integrity Group.
Mr Jarzombek shares his insights with eGov Innovation on government cybersecurity trends and the importance of building secure-quality software.
1. What trends are we seeing in the government cybersecurity space?
The government, which includes the civil sector, defense and intelligence community, is placing more emphasis on information sharing relevant to cyber risks, including threats and vulnerabilities in the Internet of Things (IoT). Today, software enables and controls critical infrastructure and services provided by the government, and at the same time government and infrastructure mission and business functions have risks attributable to exploitable software. The challenge has been that government, like critical infrastructure owners, has external dependencies on suppliers of software and IoT devices that might be subject to exploitation. As such, there is a growing interest in software supply chain risk management.
2. How different is government cybersecurity compared to private sector cybersecurity?
Differences are primarily associated with accountability and liability for residual risk exposures. Software suppliers have little or no liability for the exploitation of their products, even if used in critical infrastructure. User enterprises are the ones subject to the residual risk exposures attributable to exploitable software. It is within the specific sectors that differences are seen, and there is no single set of standards that are relevant to all organizations. From a cyber risk perspective, government is similar to industry organizations that own and operate critical infrastructure because both are accountable to citizens when something goes wrong. While many software suppliers have improved their processes for developing and delivering more secure software, they have no liability associated with anything going wrong with their software. That’s why it is important for government and critical infrastructure owners to require independent testing of software prior to it being accepted and used.
3. As a former director at DHS and DoD, what were the most challenging security problems facing government organizations?
In both DHS and DoD, many security problems are attributable to lax ‘cyber hygiene’ in development and use of software which typically is not adequately tested for vulnerabilities and exploitable weaknesses prior to being put into use or patched in a timely manner after being put into use. Both DHS and DoD spend enormous amounts of effort in responding to growing threats; yet they do not spend a corresponding amount of effort to harden the attack vectors by mitigating exploitable weakness and vulnerabilities. Acquisition and procurement organizations often fail to address the security needs for testing software that controls mission capabilities. While organizations can attempt to understand and react to threats, those organizations cannot control the threats; however, they can control attack vectors. Unfortunately, many organizations have made it easy for hackers to exploit software that controls and enables mission capabilities. Vulnerability of the target victim organization’s assets is often more of the issue associated with exploitation than the ingenuity of the attacker.
Want the Full Solicitation & Recompete Pipeline on This Topic?
GovPurchase tracks 1.2M+ active and historical records, contracting officers, and expiring awards.