Bob Gourley

Transition for One of The Nation’s Greatest Enterprise CTOs: Dave Mihelcic Retires From DISA

Bob Gourley February 17, 2017

Editor’s note: Dave Mihelcic has been a leader, mentor and friend to thousands, including me. I wish him the very best in his transition from government service. It was great to see how DISA honored him with with a farewell release on their site. Find and follow Dave on LinkedIn here. -bg

The following is from: DISA CTO Retirement
Chief technology officer to retire after 31 years of government service

The man who ensured the services and capabilities the Defense Information Systems Agency develops are technically in sync with the director’s strategic vision will retire after 31 years of government service in a ceremony at the agency’s Headquarters Feb. 21.

David Mihelcic, DISA’s chief technology officer (CTO), served 19 years at the agency and his legacy endures through the programs the Office of the CTO was responsible for.

Mihelcic’s team developed the Global Information Grid (GIG) Convergence Master Plan, which lays the foundation for transforming the DOD network and business and command and control applications into a converged, modern set of services riding on a single Internet Protocol (IP) network. He was responsible for planning and fielding the DOD’s first two-way Global Broadcast System, providing service at 21 sites in Southwest Asia in support of post-9/11 contingency operations. He also orchestrated an unprecedented agreement between the Chief Information Officers of the DOD and the intelligence community, which identified an area of sharing that avoided $12 million in redundancy and served as a precedent for future opportunities.

Prior to his appointment as CTO, Mihelcic served as the deputy program director for the Global Information Grid Bandwidth Expansion (GIG-BE), chief executive engineer (CEE) for the Defense Information System Network (DISN), commander of the Center for Horizontal Integration, and deputy CEE for Information Processing at DISA. He also worked at the Naval Research Laboratory (NRL) for 14 years, and had a brief stint as a senior consultant in private industry.

His decision to pursue government service at the NRL and DISA, as well as his plans for the future, are heavily influenced by his willingness to support the military services and, specifically, the warfighter.

After graduating from the University of Illinois with a degree in electrical engineering, he sought to work for the Department of Defense. He eventually chose an engineer position with NRL after looking at jobs within the various military services, and with industry positions in support of the military services.

“I started as a GS-7. I left as a GS-15,” said Mihelcic. “I started as an engineer working in communication security, basically working with National Security Agency encryption products, and eventually ended up being one of the founders of what would become the Navy’s information assurance program.”

Mihelcic remarked that his proudest accomplishment in government service was before his appointment as the DISA CTO.

While serving as the deputy program director and CEE for the GIG-BE program, his team virtually eliminated the bandwidth constraints in the DOD’s terrestrial network.

“We had an $877 million investment. We acquired commercial fiber optic cable. We lit that cable with the most leading-edge technologies available. We made it available to warfighters as high-speed IP, with NIPRNet and SIPRNet services available,” said Mihelcic. “Really, that’s completely changed how the Department does business, and quite frankly, it has changed DISA as well.”

In addition to the technological advancements the DOD and the military services would reap from GIG-BE, there were other benefits DOD and DISA would gain from the program.

“Not only did we get this huge infusion of technology, but we got the infusion of skills and people,” said Mihelcic. “There were contractors that worked for us when we conducted the GIG-BE program that subsequently came to work with us as government employees … and I feel that today, the reason that we are so successful in the long-haul communications business is because of that great work we did in the GIG-BE program and the great people we attracted to DISA.”

Following his service with NRL and industry, his tenure at DISA almost didn’t happen. After applying, and subsequently being offered the job, he initially declined the job offer.

“The chief of staff at DISA, Army COL Frank Whitehead, called me to say, ‘I can’t offer you more money, but I can guarantee that you are going to help the warfighter,'” said Mihelcic. “I thought about that, and I thought about the importance of the DISA mission, so I took the job and I’ve been here ever since.”

Mihelcic said the DISA CTO is responsible for oversight of all technology at the agency through the Chief Engineers Panel, which brings together the senior technical representatives of all of DISA’s projects and programs. He stated that in addition to this oversight, his team ensures DISA has a pipeline of relevant concepts and technologies to inform and guide the agency’s activities moving forward.

“We ensure that what DISA does is technically in sync with the Director’s strategic vision, has good systems engineering, and is scalable, secure, and survivable,” said Mihelcic.

The CTO went onto say he is going to miss the people and the mission.

“The CTO has some of the best and brightest in all of DISA, and they have a very difficult job because instead of working on one of the core programs, whether it be the DISN, or computing, or Global Command and Control, they really have to work in support of everything DISA does – the entire mission.”

He said CTO has to interact with the Chief Strategy Office, work with all of the left- and right-side functions, as well as to work with industry, academia, and other government organizations.

“I think the people we have in the CTO, because they have this broad experience in everything that DISA does, they are really the right people for that job,” said Mihelcic.

In addition to missing the people at DISA, he reiterated the reason he came back to government service after his brief time as a consultant was primarily due to the DISA mission and the opportunity to support the warfighter.

“The one thing that COL Whitehead told me that I could get at DISA that I couldn’t get anywhere else was that ability to influence the mission and really help the warfighter,” said Mihelcic. “I am really going to miss that, because I think DISA has done great things for the Department of Defense and the warfighter. I think we’re going continue to do great things, and I really hope in my next job I can find at least some semblance of that. A place where I can actually influence the future.”

After reminiscing about his 31 years of service, Mihelcic ended with these words.

“We have great people. We have a great mission. And as long as DISA leadership empowers and trusts our people to do the right thing, we will accomplish whatever goal is set forth.”

Posted February 17, 2017

CTOvision named to FedTech’s list of 50 Must-Read Federal IT Blogs

Bob Gourley December 23, 2016

We were honored again to be named to FedTech’s list of 50 must-read federal IT Blogs.

From FedTech’s intro to the list:

It was a whirlwind year in the world of federal IT, with the White House, Office of Management and Budget, and many agencies focused on cybersecurity, IT modernization, data center closures and optimization, and cloud adoption. Sometimes, it’s hard to keep track of technology developments, directives from agency heads and regulatory changes — and how agencies are responding to them.
FedTech is coming to the rescue. As we have for several years now (in 2015, 2014, 2013 and 2012), we have compiled a must-read blog list for those in federal IT. The list is balanced pretty evenly between blogs we have recommended in the past and new entrants.
This year, there is a particular focus on blogs produced by think tanks and research organizations, which will be valuable in providing outside perspectives on the technology and cybersecurity policies the incoming Trump administration will pursue.

We appreciate being on FedTech’s list and our intent is to continue to dive into the issues enterprise techies need to track, especially those issues around: Cloud Computing, Artificial Intelligence, Mobility, Big Data, Robotics, Internet of Things, CyberSecurity.

Please take a moment to ensure you are on the right distributions for the content you need most. Do that at our Newsletter Signup page.

The First Quantum Revolution: Foundational information for the enterprise CTO

Bob Gourley December 22, 2016

Our report on Naturally Better Security dove deep into ways quantum effects can be leveraged to enhance real world cybersecurity. It was our most popular post in November 2016 and the feedback we received was taken as a signal that we should produce more on what CTOs should know about the quantum world. With this post we are kicking off a series of five pieces that will dive into quantum effects. This first post tackles some foundational background that puts the science into a historical context. The second one will discuss the current revolution in quantum computing. The third focuses on security concerns. The forth dives into quantum key distribution. The fifth hits on the “so-what” of the current revolution in terms of security.

So first, foundational background on quantum mechanics.

Dr. Jane Melia of Quintessence Labs is known for her knack in expressing complex quantum related concepts both clearly and succinctly. We asked her to encapsulate everything we needed to know about the history of quantum mechanics and here is what we got:

At the start of the twentieth century, scientists believed that they understood the most fundamental principles of nature. From Galileo to Isaac Newton, the motion of bodies had been understood, whether for an apple falling from this tree, or the motion of planets around our sun. By understanding how parameters such as force, mass, and acceleration interacted, we had a good understanding of how objects in motion behave, and more broadly of the world around us.

But some physical behaviors cannot be neatly described by classical physics. One such behavior that people were trying to understand at the end of the 19th century was called the black body problem. It was about how to describe radiation coming from solid bodies such as the stars and galaxies in our universe, which did not fit with the laws of classical physics.

By trying to understand this, scientists started to realize that classical physics did not fully represent all physical behavior. Max Planck found a solution for the black body problem in 1901, but to do so, he had to assume that energy came in discrete quantities; he referred to these as quanta. This was definitely at odds with the understanding of the day that radiation consisted of waves, but it worked.

Throughout the following decades, further findings by giants such as Albert Einstein, Niels Bohr, Heisinger, Schrödinger, and many more, confirmed this notion of the quantum of energy, giving birth to quantum mechanics. Core principles were formulated, which are counterintuitive and confusing but have been borne out by numerous experiments. These principles include the wave particle duality, i.e. the fact that particles sometimes behave like waves, and that waves sometimes act like particles, or that quantum particles can exist in a superposition of different states until observation takes place, as famously told in the thought experiment of Schroedinger’s cat, and also that quantum systems can show connected behavior at a distance, without any direct physical interaction, what became known as “spooky action at a distance”.

It turns out that while classical physics works well enough at scales greater than the atom and speeds much lower than the speed of light, outside of this domain, real observations do not match what classical mechanics predicts – quantum physics is more accurate and broadly applicable.

Quantum physics helped us understand the periodic table, chemical interactions, and electronic wave functions that underpin the electronic semiconductor physics. In fact, there are many devices available today which are fundamentally reliant on our understanding the effects of quantum mechanics. These include the transistor, lasers, GPS, semi-conductor devices and MRI imagers. These devices are often referred to as belonging to the ‘first quantum revolution’.

What’s amazing is that within one silicon chip there are about 3 billion transistors, enabled by the progress of this first quantum revolution. And they all have to work reliably so that your computer, your mobile phone or whatever you have actually works. Now that’s quite amazing. Just think about that now. If you look around you now, we all carry around our personal electronics. Everyone reading this post is probably an owner of multiple computers and smartphones, will at least tens of billions of transistors at your command, all enabled by the progress of this quantum revolution. So while the science behind them is certainly confusing, quantum technologies are already part of our everyday life.

This is all due to the first revolution in quantum mechanics. Now a second revolution is underway. For more on that see our next post on The Second Quantum Revolution: Employing quantum mechanics to alter our world.

Be sure you don’t miss any of this series: Check your newsletter subscriptions at our Newsletter Signup page.

For more see:

Quick Look On Report of the President’s Commission on Cybersecurity

Bob Gourley December 2, 2016

The report of the President’s Commission on Enhancing Cybersecurity has just been posted to the White House Website. You can download the report here).

My quick thoughts:

If you are a technologist or a security expert or have been tracking security issues, you can skip the first 10 pages. You know the state of things. This section is not meant for you.
The recommendations of the report are well thought out and worth you slowing down and reading carefully.
Most all of the recommendations require action by the new administration. But those of us in industry and academia can help here too. So can Congress.

I’ve reviewed all the recommendations and can see the wisdom of what is being suggeted here. I would like to have seen one other recommendation, a meta-recommendation, that makes it clear that the most important thing any of us can do to enhance security is to take responsibility for our own IT. Maybe that was implied here. But I would have liked to see that hit head on. But still, call me a supporter of the report and its recommendations.

DoD Contractors: Complying with new DFARS regulations is easier with external help

Bob Gourley November 28, 2016

If you are a DoD contractor of any size, including sub contractors to other contractors, you no doubt have already heard of the new changes to the Defense Federal Acquisition Regulations (DFARS) requiring enhanced security controls over contract info. The regulations are specific and will be costly. The good news is that the cost of compliance is considered an allowable cost under Federal Acquisition Regulation (FAR)/Cost Accounting Standards (CAS), which means if you do things smartly the government will allow you to role the cost into what is allowable for rates you charge. More good news is that when you engage external help in complying with DFARS you can leverage the talent of people who know the most efficient way to get these things done. This can not only get you into compliance but can make you more secure and save you money.

Digital Risk Management Leader RiskIQ Raises New Funding To Expand Platform Ecosystem, Sales and Digital Risk Applications

Bob Gourley November 10, 2016

Editor’s note: When I read of a great firm like RiskIQ investing to expand their platform I immediately think of the positive impact to current and future customers. But strategically this also means that large teams of investors believe strongly in the powerful capabilities and strong future of this company. With that in mind we share a RiskIQ press release below -bg

Digital Risk Management Leader RiskIQ Attracts $30.5 Million in Series C Funding

New Capital Infusion to Expand Platform Ecosystem, Sales and Digital Risk Applications

SAN FRANCISCO – November 10, 2016 — RiskIQ, the leader in digital risk management, today announced that it closed $30.5 million in Series C funding led by Georgian Partners. Existing investors Summit Partners, Battery Ventures, and MassMutual Ventures also participated in the round, further validating the company’s leadership position and market opportunity. This financing will enable the company to expand its ecosystem, global sales, and platform applications within the disruptive Digital Risk Management market.

Threats outside the firewall are vast and dynamic. RiskIQ provides organizations access to the widest range of security intelligence and applications necessary to understand exposures and take action – all without leaving the platform. Similar to Google, RiskIQ applies machine learning and data science to continuously improve platform intelligence and broaden functionality by leveraging big data, customer usage and attack activity. With RiskIQ, enterprises can efficiently defend their digital attack surface, pinpoint exposures across their business, and dynamically mitigate cyber threats across web, mobile, and social.

Since 2009, RiskIQ has enabled security staff to reduce the time needed to understand new threats, speed up investigations, and more effectively prevent and remediate incidents. The company helps protect some of largest and most trusted names in financial services, technology, retail, government, healthcare, media and manufacturing around the world, including Facebook, DocuSign, UnderArmour, Lagardere, and Publishers Clearing House. RiskIQ was recently named a leader for Digital Risk Monitoring and received the highest score for the current offering category in The Forrester Wave™: Digital Risk Monitoring, Q3 2016. In the first half of 2016, the company reported year-over-year bookings growth of 80 percent, growing bookings and new customer acquisition for every product in its platform. Through RiskIQ’s revamped channel program, the company has successfully penetrated European and Asian markets. Today, RiskIQ has more than 200 enterprise customers, over 13,000 security analysts using the RiskIQ platform, and hundreds of users subscribing to the RiskIQ PassiveTotal digital threat investigation tool each week.

“We are pleased to have Georgian Partners as part of our strong investment and advisory team. Georgian, like RiskIQ, was founded by entrepreneurs. We share similar business values and philosophies,” said Lou Manousos, CEO and co-founder of RiskIQ. “They know what it takes to develop a business into a customer-focused, long-lasting, and profitable company – values that our entire board of directors shares.”

“RiskIQ has already designed the platform to dominate the Digital Risk Management market, and we are excited to contribute to their success,” said Steve Leightell of Georgian Partners, who will join the Board as part of the transaction. “Our team of experts in applied analytics, applied artificial intelligence and security first could not be better suited to partner with RiskIQ on their next phase of growth,” said Justin LaFayette, managing director at Georgian Partners.

Greg Goldfarb, managing director at Summit Partners, added: “The future of security is connecting the inside and the outside of the enterprise boundary. Threats start outside the firewall, move inside, and exfiltrate data back outside – and all the while malicious actors can compromise a company’s digital assets, vendors, and customers across web, mobile, and social environments. RiskIQ lights up the entire digital world outside of the controlled perimeter and connects that activity to a company’s internal security regime for 360-degree security.”

Michael Brown, general partner at Battery Ventures, added: “You only need to read the headlines to see that cyberattacks are taking their toll on organizations who fail to extend security controls beyond the firewall. While the majority of data breaches are from external sources, addressing the problem with traditional security tools is inefficient. RiskIQ has built the right commercial platform to manage a broad range of digital threats in an agile way that can address future attack vectors. We believe the company is well positioned to capitalize on this tremendous market opportunity.”

About RiskIQ

RiskIQ is a cybersecurity company that helps organizations discover and protect their external-facing known, unknown, and third-party web, mobile, and social assets. The company’s External Threat Management platform combines a worldwide proxy and sensor network with synthetic clients that emulate users to monitor, detect, and take actions against threats. RiskIQ is used by thousands of security analysts including many from the Fortune 500 and leading financial institutions to protect their digital assets, users, and customers from external security threats. The company is headquartered in San Francisco, California, and backed by Summit Partners, Battery Ventures, Georgian Partners and MassMutual Ventures. Information security professionals can sign up for a fully functioning trial version of PassiveTotal for free by visiting www.riskiq.com/whats-new-passivetotal.

To learn more see the CTOvision Solutions Directory: RiskIQ

Nation-Blanking DDoS Attacks Launched By Individuals Now Proven Able To Take Entire Nation’s Off The Net

Bob Gourley November 3, 2016

We live in times of extreme technological hooliganism, where small groups or even individuals can cause asymmetric damage from a distance. This was proven several times over the last few months, most famously in the 21 October attacks against Dyn that impacted many of Dyn’s clients, including Amazon, Twitter, Reddit, Airbnb, New York times, Spotfiy, Netflix and many others sites.

Conversations with researchers throughout the community and analysis of motives of recent large attacks like that one lead us to conclude that these large attacks are not the result of nation states attacking our infrastructure. This is very likely one or maybe two individuals causing this havoc.

That point should make you think of two things:

If lone actors could do this, consider what many lone actors could do acting individually or collectively
If lone actors could do this, consider what a nation could do

Other interesting thoughts arise when the size of the attacks are considered. According to the Verisign DDoS Trends Report for 2Q2016, peak attack volume for DDoS Attacks was coming in 256 Gigabits per second (Gbps). The big attacks in October were over 1 Tbps, a big leap, and predictions that soon botnets capable of 14 Tbps in size may be conducted very soon.

Very few businesses and very few ISP’s can withstand an attack of 1 Tbps. That size attack can threaten entire segments of the economy and even nations. And with even larger capabilities coming, Nation-blinding attacks can be expected.

Today saw proof that at least one nation-blinding attack has been tested. A new botnet began targeting Liberia in west Africa 2 and 3 Nov. The attack was brief, leading some researchers to conclude it was a test. Many of us believe this too was the act of a small group, not another nation. Someone is doing this for kicks.

Clearly the ability to conduct these attacks is growing. I estimate capacity for this attack will grow by an order of magnitude over the next 30 days. Imagine what size attacks will be possible in just 30 days. Imagine Venezuela, Colombia and Ecuador all being taken offline at the same time. Or you pick the other countries that get hit. Or imagine the companies that make up your supply chain being hit hard. This could have an impact on you.

Or imagine eBay, Amazon and Walmart being taken out before people get a chance to order holiday gifts. Or imagine the Post Office, FedEx and UPS being taken out for days or weeks. What would that do to your personal and/or business life.

Worse yet, imagine financial clearing houses being disrupted, slowing financial settlements.

The 9/11 attacks were failures of imagination. Lets not repeat that mistake in not thinking through the impact of nation-blanking attacks. Lets imagine the damage and then find better ways of taking collective action to mitigate them.

What can be done to prevent this attack or mitigate the impact of similar attacks when they occur? We provide our thoughts here, segmented into recommendations for Home Users, Business Users and Local, State, Federal Governments. And we are updating all that guidance now to underscore, you have to find backup ways to communicate and we recommend doing so asap.

American Industry Benefiting From Government Cybersecurity Executive Transitions

Bob Gourley November 3, 2016

One of the bright spots in the cybersecurity community is the corporate awakening to the need for highly competent executive level talent. Businesses in every sector of the economy and of all sizes are realizing that effective cyber risk mitigation is not just a matter of buying new technologies or turning on a firewall. Mitigating risks while enabling business requires executive talent that can understand and empower business objectives but take systematic, cross-organizational action to strategically reduce the threat to the business.

Now the issue becomes where to find this talent. For decades corporate America has turned to former government executives as a source of talent. Most fortune 500 firms will have former FBI, CIA, NSA, DIA or DoD cybersecurity professionals in leadership positions. Over the last few years this trend has only accelerated.

We found great context on this trend in this Chief Security Officer Magazine article by Benchmark Executive Search’s Jeremy King titled: “National Security Brain Drain.” Jeremy writes in part that:

Whether defending from adversaries to include nation states, crime groups, extremists, and hackers, their unique understanding of the complex threat landscape, methods and capabilities used to combat these threats is now what corporate America needs. Their sense of patriotism and mission continues and will now help protect some of our country’s top brands and companies.
Since the critical infrastructure is primarily owned and operated by the private sector, our government can’t be expected to solve all the problems in keeping America safe. Industry must take the lead. We have seen the demand for these accomplished leaders skyrocket as forward-looking corporate CEOs and boards are turning to these former national security and cyber government officials to gain expertise, insight and address the growing need to combat a full spectrum of enterprise risks.

American industry has always benefited from the talent produced by the U.S. government, especially those with national security experience. The demand signal from industry and the needs to secure our nation’s economy indicate more of this talent will be needed in the future. There are issues here of course. Will industry demand cause more in government to decide to leave earlier and will that cause impact to important agency missions? How will agencies mitigate their risks if that happens? Those are challenges, but overall it seems America needs this talent to protect the economy and government should prepare and adapt to meet these changes.

I should also mention that for many mid-sized companies there will not be enough of this talent to go around. What does the small to mid-sized firm do when they want high end cybersecurity talent on their side? They contact ooda llc of course.

Transition for One of The Nation’s Greatest Enterprise CTOs: Dave Mihelcic Retires From DISA

CTOvision named to FedTech’s list of 50 Must-Read Federal IT Blogs

The First Quantum Revolution: Foundational information for the enterprise CTO

Quick Look On Report of the President’s Commission on Cybersecurity

DoD Contractors: Complying with new DFARS regulations is easier with external help

Digital Risk Management Leader RiskIQ Raises New Funding To Expand Platform Ecosystem, Sales and Digital Risk Applications

Nation-Blanking DDoS Attacks Launched By Individuals Now Proven Able To Take Entire Nation’s Off The Net

American Industry Benefiting From Government Cybersecurity Executive Transitions

Cyber War

This One Little Configuration Change Will Make It Harder For People To Steal Your Information

Think Twice Before Deciding To Use A Personal VPN: You could be getting some really bad advice

Please help spread the word: USNI and NIP Essay Contest: This year’s challenge area a key one for the nation

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

HBO’s Westworld: The Man In Black is a special kind of Twitter user

All Enterprise Techies Should Watch HBO’s SciFi Epic Westworld: It will help us dialog over shared experiences on what we will not be creating

Bob Gourley

More Content

Cyber War

SciFi