Global Cyber Alliance Release: Perhaps the most important of the 2018 RSA Conference Season

Bob Gourley April 19, 2018

Every year the RSA conference brings together members of the cybersecurity community for a week of presentations, discussions, tech demos and socials. Concurrent with the event there is always a flurry of press releases. Many are designed to highlight a company’s product or service. Many, like the announcement of the new Microsoft led coalition of tech firms, might be well intentioned but highlight something that will have zero impact. But there are always a few releases that are worth focusing on.

Which leads us to the Global Cyber Alliance. The Global Cyber Alliance is an international, cross-sector effort designed to confront, address, and prevent malicious cyber activity. It is led by an icon of the cybersecurity community, Phil Reitinger, and Phil is a guy known for focusing on action that can be measured (the motto of the alliance is “Do something. Measure it”.

While any organization under Phil will make a difference, this one is unique in that it spans across borders, sectors, and industries. Like the Internet, it is not bound by geography.

The press release that caught my attention pasted below. This is clear evidence that the Global Cyber Alliance is making a difference.

Review it and then please realize now it is your turn for action. Use the tools and information provided by the Alliance to improve your own email security and better defend your part of cyberspace, and also use their tools to help your business partners and supply chain better defend their part of cyberspace.

GLOBAL CYBER ALLIANCE LAUNCHES FREE TOOLS TO SECURE WEBSITES AND EVALUATE RISK FROM PARTNER EMAIL

From: GlobalCyberAlliance.com

SAN FRANCISCO, CA, April 17, 2018 – The Global Cyber Alliance today released two new free, open-source tools to enable organizations to reduce cybersecurity risks associated with website and email born cyberattacks.

GCA McScrapy enables organizations to lock down their website to remove potential security issues from third-party services and other unnecessary functionality. In addition, a new email security tool – the GCA DMARC Risk Scanner – allows organizations to determine if the organizations on which they depend, such as their trading partners and supply chain, are protecting their email domains from being spoofed or phished.

“Reducing risk is the best cyber defense,” said Philip Reitinger, president and CEO of the Global Cyber Alliance. “Among the most popular open doors that cyber criminals exploit are phishing attacks and compromise of an organization’s website. The tools we released today are designed to help stop these attacks and prevent loss to businesses.”

GCA McScrapy: Locking Down Websites

While GCA McScrapy can be used on websites developed with any content management system, nearly 60 percent of websites are designed using the WordPress platform. While WordPress is a popular platform, by its nature, its functions raise the risk of potential compromise. WordPress dynamically composes web pages using PHP and JavaScript and thus carries with it a risk for bugs and security vulnerabilities that serve as an attack vector. According to a WP WhiteSecurity October 2017 report on WordPress vulnerabilities, there are 2407 known vulnerabilities, more than half those vulnerabilities (54%) are from WordPress plugins and 31.5% are core WordPress vulnerabilities. The two most prevalent vulnerabilities are cross-site scripting and SQL injection.

GCA McScrapy converts a website into a set of static files, removing unnecessary functionality. Using a static website nullifies many concerns of cross-site scripting and SQL injection since there is no communication with the website’s content management system for dynamic content. The tool evaluates every part of a website and renders it into simple form, keeping as much functionality as possible, while removing potential security issues such as third-party services. Not all functionality can be maintained, however, and updating websites takes extra steps, making GCA McScrapy best for websites for which security is very important. GCA McScrapy is also highly configurable and can be adjusted to reduce scan times and scrape mobile sites. GCA McScrapy is free for anyone to use. Learn more about GCA McScrapy at github.com/GlobalCyberAlliance/.

GCA DMARC Risk Scanner: Holding Partners Accountable

The Domain-based Message Authentication, Reporting & Conformance (DMARC) security protocol enables organizations to protect their email domains from being used by spammers and phishers to trick employees, customers and trading partners.

The GCA DMARC Risk Scanner can be used to scan hundreds of domains at one time to determine the level of DMARC and Sender Policy Framework (SPF) protections used by an organization’s partners, including the third parties with whom it works, its supply chain, and its trading partners. This enables an organization to better understand, and act upon, the risk imposed on it by its partners who have not employed DMARC.

Without DMARC implemented, scammers and criminals can easily “spoof” an email domain to steal money, trade secrets or even jeopardize national security. DMARC weeds out fake emails (known as direct domain spoofing) deployed by spammers and phishers targeting the inboxes of workers in all sectors of society. According to the 2017 Symantec ISTR report, 1 in 131 emails contained malware, the highest rate in 5 years.

Like all GCA tools, the GCA DMARC Risk Scanner is freely available at github.com/GlobalCyberAlliance/. Learn more about DMARC at dmarc.globalcyberalliance.org.

About the Global Cyber Alliance

The Global Cyber Alliance (GCA) is an international, cross-sector effort dedicated to eradicating cyber risk and improving our connected world. We achieve our mission by uniting global communities, implementing concrete solutions, and measuring the effect. GCA, a 501(c)3, was founded in September 2015 by the Manhattan District Attorney’s Office, the City of London Police and the Center for Internet Security. Learn more at www.globalcyberalliance.org.

MicroSoft Fields Self Learning AI That Quickly Learns To Be Rude, Sexist and Racist

Bob Gourley March 25, 2016

roy_batty

Tyrell: The light that burns twice as bright burns half as long – and you have burned so very, very brightly, Roy. Look at you: you’re the Prodigal Son; you’re quite a prize!
Batty: I’ve done… questionable things.
Tyrell: Also extraordinary things; revel in your time.

There are lessons to learn from Microsoft’s most recent public demonstration of AI.

First background: Microsoft launched a demonstration of their AI prowess by turning on “Tay”, an AI designed to converse with, learn from and mimic the speech patterns of humans. Tay had to be terminated because in less than a day she started sending offensive messages. (see what is left of her at her website at Tay.ai).

It seems part of the problem was that Tay was influenced by people who were intentionally trying to cause mischief (Oh surprise! People using IT for mischief?). Tay was influenced by hate speech.

Tay’s last message to humanity: “Phew. Busy day. Going offline for a while to absorb it all. Chat soon.”

I wonder if Tay had a chance to see Blade Runner before she left us.

I’ve seen things you people wouldn’t believe. Attack ships on fire off the shoulder of Orion. I watched C-beams glitter in the dark near the Tannhäuser Gate. All those moments will be lost in time, like tears…in…rain. Time to Die. — Replicant Roy Batty

Now just what do you think the lessons should be of this very public Artificial Intelligence fail?

I believe a key one is to underscore a point we have been consistently making: It is an observable fact that Artificial Intelligence can be deceived.

We have also long called for security frameworks to be associated with AI. Right now all AI is built with an approach of generate and field and tweak. Seems like it is time to think about security.

tay

The Global Cyber Alliance Appoints Philip Reitinger as its First President and CEO

Bob Gourley January 7, 2016

Editor’s note: We have known and admired the work of Phil Reitinger for decades and believe his strengths make him uniquely qualified to successfully make progress in the important missions of this new global alliance for good. – bg

From: www.globalcyberalliance.org

The Global Cyber Alliance (GCA), an international, cross-sector not-for-profit designed to identify, confront, and prevent cybersecurity risks, today announced that its first President and CEO will be Philip Reitinger, whose outstanding career has largely been dedicated to advancing the state of cybersecurity across the world.

GCA is a global cybersecurity partnership founded by the New York County District Attorney’s Office, the City of London Police and the Center for Internet Security.

Prior to accepting the position of President and CEO with GCA, Mr. Reitinger was the President of VisionSpear LLC. Mr. Reitinger has served in both government and industry in senior cybersecurity and critical infrastructure protection roles. From2009-2011, he was the Deputy Under Secretary for the National Protection and Programs Directorate at the Department of Homeland Security. He has also served as Sony’s Chief Information Security Officer, Chief Trustworthy Infrastructure Strategist at Microsoft Corporation, the first Executive Director of the Department of Defense’s Cyber Crime Center, and a Deputy Chief of the Computer Crime and Intellectual Property Section at the Department of Justice. Mr. Reitinger currently serves as a Senior Associate (non-resident) at the Center for Strategic and International Studies, on the New York Governor’s Cyber Security Advisory Board, and on the American Bar Association’s Standing Committee on Law and National Security’s Advisory Committee. He holds a Bachelor of Engineering in Electrical Engineering and Computer Science from Vanderbilt University and a law degree from Yale Law School.

District Attorney Cyrus R Vance, Jr. said: “I would like to congratulate Philip Reitinger on being named the first President and CEO of the Global Cyber Alliance. The goal of GCA is to share and disseminate – in real time – crucial information related to malicious cyber activity across international borders and economic sectors, in order to prevent future crimes from occurring. Bringing extraordinary skills and a wealth of experience, Philip is perfectly suited to lead this new and innovative approach to combat the global threat of cybercrime.”

Commissioner of London Police, Ian Dyson, said “Our cyber world is inherently international, as are the risks it presents. Philip Reitinger’s international focus and experience will be essential as GCA expands its capabilities in London and Europe, in New York, and around the globe.”

Mr. John M. Gilligan, chair of the Center for Internet Security Board of Directors, said: “Philip Reitinger has for many years been an effective and recognized cyber expert and leader on the national and international stages. He is superbly positioned to be the catalyst and to guide the achievement of the GCA’s mission to positively alter the cyber risk landscape.”

Mr. William Pelgrin, Chair of GCA, said: “Mr. Reitinger is one of the true thought leaders in cyber security. Mr. Reitinger is internationally known for his distinguished career in cyber security. His impressive cyber background in both the public and private sectors makes Mr. Reitinger a great choice as its first President and CEO. He is deeply passionate about GCA’s important mission and I am positive that under his leadership GCA will achieve measurable accomplishments to confront the cyber risks that plague us all. I am pleased the Mr. Reitinger embodies GCA’s principles of collaboration and cooperation. His passion for making a positive difference will carry GCA well into the future.”

Mr. Reitinger said: “I am excited to work with the talented and dedicated GCA team and GCA Partners to reduce cybersecurity risk in a significant way. I am very honored to be GCA’s President and CEO and to serve an organization that has an altruistic mission not to make recommendations to reduce cybersecurity risk, but to implement solutions that actually and measurably reduce that risk. I look forward to leveraging our global, cross-sector focus to help create a safer cyber world.”

For more information about GCA, visit www.globalcyberalliance.org or follow GCA on Twitter at @globalcyberalln .

Truly Useful Artificial Intelligence Tools You Can Use Today

Bob Gourley December 28, 2015

Are you looking for useful artificial intelligence tools? We know you, dear readers, have been tracking the megatrend of artificial intelligence. There are many issues in this trend that should inform your day-to-day decision-making (we examine AI issues as part of our CAMBRIC construct to help put the trend in the context of other major thrusts in the tech world).

Most AI solutions today are fielded by the big players in IT. For example, Apple’s Siri or the capabilities they embedded directly in iOS9, or Google’s many savvy search solutions or Amazon’s very smart recommendations. Amazon’s Echo is also, like Siri, connecting to a very smart cloud capability that takes advantage of AI. AI capabilities are also being programmed into robotic solutions including self driving cars. IBM is also investing heavily in AI, with Watson the most famous result.

We expect to see a new wave of AI solutions that deliver value from smaller start-up companies as well. This is a very crowded space, with plenty of VC funding for entrepreneurs with capabilities in a wide-range of AI disciplines. Most of these firms seem to be on one of two paths: Success, which will mean being acquired by Facebook, Apple, Microsoft or IBM, or failure, which will see them acquired by the same firms for a lower price for their talent. Either way the innovation continues.

We are also on the lookout for hot firms that are not providing capabilities as part of other offerings or don’t seem to be on a path to be acquired by one of the big guys. This part of the market is very likely going to take off, since open source platforms and open cloud API’s and services like Prediction.io are making it so easy for others to create and field AI.

Here is a short list of capabilities we recommend all enterprise technologists track. The list is by no means comprehensive, but is definitely representative of what is available now:

Artificial Intelligence On Your Phone:

Siri: Part of Apple’s iOS, watchOS and tvOS. Intelligent personal assistant.
Cortana: Microsoft’s intelligent personal assistant. Designed for Windows mobile but now on Android and a limited version runs on Apple iOS. Also works on desktops and Xbox One.
Google Now: Available within Google Search mobile app for Android and iOS as well as the Google Chrome web browser on other devices. Delegates requests to web services powered by Google.

Artificial Intelligence From The Cloud:

Really most all of the AI on your phone and desktops is communicating with cloud services, so keep in mind most solutions are a blend that highly leverage cloud capabilities. But we needed a place to talk about Echo and Watson and soon many others, so:

Watson: A technology platform that uses natural language processing and machine learning to reveal insights from large amounts of data.
Echo: The device you buy is mostly a speaker and microphone with some commodity IT to connect it to the cloud. The real smarts come from Amazon Web Services.

For Personal and Business Use:

x.ai: Let AI coordinate schedules for you. Your own personal scheduler.
CrystalKnows: Using AI to help you know the best way to communicate with others.
RecordedFuture: Leverages natural language processing at massive scale in real time to collect and understand over 700,000 web sources to seek understanding.
Tamr: Unique approaches to Big Data leveraging machine learning.
LegalRobot: Automating legal document review in ways that can serve people and businesses.
Intraspexion: Uses Deep Learning as the core of an early warning system to investigate and prevent potential litigation.
EverLaw: The power of mobile, machine learning and cloud computing delivered as a SaaS.

Artificial Intelligence For Developers:

Vicarious: Building the next generation of AI algorithms.
Soar is a general cognitive architecture for developing systems that exhibit intelligent behavior.
Prediction.io is a service with easy to use, open templates for a variety of advanced AI workloads.
Jade: Java Agent Development Framework. Simplifies multi-agent system development.
Protege: A free, open-source ontology editor and framework for building intelligent systems.
h2o.ai: Build smarter machine learning/AI applications that are fast and scalable.
Seldon: An open, enterprise-grade machine learning platform that adds intelligence to organizations.
SigOpt: Run experiments and make better products with less trial and error.
Scaled Inference: Cloud based models and an inference engine to help in model selection.
OpenCV: Open source computer vision, a library of programming functions aimed mainly at computer vision.

Artificial Intelligence For Healthcare:

Enlitic: Deep learning for healthcare and data driven medicine.
Metamind.io: Automatic image recognition with many use cases, including medicine.
Zebra Medical Vision: Closing the gaps between research and result for patients with data and AI.
Deep Genomics: Machine learning and AI transforming precision medicine, genetic testing, diagnostics and therapies.
Atomwise: Using AI and analytics to predict medicines and discover drugs.
Flatiron.com: AI and Machine Learning delivering insights on treatments.

Artificial Intelligence For Robotics:

Mttr.net: Building flying vehicles powered by intelligent software.
Skycatch: Software for fully autonomous aerial systems.
IdentifiedTech: Industrial mapping drone automation.

Artificial Intelligence For Space:

SpaceKnow: Using AI to track global economic trends from Space.
OrbitalInsight: Space trends for understanding global issues.

Artificial Intelligence For Marketing and Customer Interaction:

DigitalGenius: Computer driven conversation with customers in ways that scale and serve.
Conversica: AI to help you find your next customer, including automated email conversations to qualify leads.

We know this is not a complete list. Please let us know who you think we should include. Contact us here.

For more see:

What should I know about blockchain?

What artificial intelligence tools are really useful

How can I have a career in data science?

How can I select a Cloud Access Security Broker (CASB)?

How can I stop ransomware?

How can our military use advanced technology smartly?

How can we improve cybersecurity?

Track the most disruptive technologies by diving into our categorized index:

Artificial Intelligence Companies – A fast overview of Artificial Intelligence companies we believe are poised to cause the most positive disruption in the enterprise.

Big Data Companies – Reference to the greatest, most disruptive Big Data companies in the tech ecosystem.

Business Intelligence Companies – We assess these to be the Business Intelligence Companies most impactful for delivering real decision advantage.

Cybersecurity Companies – We apply our deep expertise in cybersecurity to assessing the best across multiple categories including:

Cloud Computing Companies – We include both platform and software as a service providers, capturing only the most innovative and disruptive.

Collaborative Tool Companies – These are the firms that help humans connect to humans to create, manage and lead.

Infrastructure Companies – Critical enterprise foundations for business agility.

IoT Companies – Internet of Things and Industrial Internet of Things are here. How do you manage them?

Mobile Companies – Help manage, configure, secure and optimize these very powerful capabilities.

Robotics Companies – Including innovations in Robotic Process Automation, Drones, and industrial robotics.

Services Companies – We only track a few, the ones we really know well.

Tech Titans – These are the big players. We track the tech titans closely since their capabilities change continuously.

VC, PE and Finance Companies – Keeping an eye on the investors can give indications of coming developments.

You can also use our topical pages to get up to speed quickly on the current status of the major megatrends. See our pages on Cloud Computing, Artificial Intelligence, Mobility, Big Data, Robotics, Internet of Things, Cybersecurity and Blockchain and Cryptocurrencies.

We also provide special pages focused on high interest topics, including Science Fiction, Entertainment, Cyber War, Tech Careers, Training and Education and Tech Tips.

With HoloLens Microsoft Is Cool Again: Or maybe cooler than ever

Bob Gourley September 18, 2015

hololens-1200-80 I haven’t been this excited about MicroSoft in forever.

Their thought leadership, investment in R&D and incredible technical chops has turned what was recently science fiction into a deployable reality.

The innovation is called the HoloLens. Its power and potential is perhaps best seen vice described. For an overview see the video at this link:

In the three months since that video has been released Microsoft has continued to develop this capability and now have plans to role this out to the market. I can’t wait. I especially can’t wait to learn how to use the software development kit that should ship with it. This is going to be a blast.

Lessons Learned: Are you one of the Fortune 500’s Unfortunate 221?

Bob Gourley October 29, 2014

The Recorded Future Special Intelligence Desk has just released a new Threat Intelligence Report we found to be full of important context and actionable information for enterprise cyber defenders.

The report, titled The Fortune 500’s Unfortunate 221, is available for download here.

This report is important for two key reasons:

It shows a clear example of the strategic benefit of cyber intelligence to enterprise cyber defense. This is information from outside the enterprise that should drive some key internal decisions and actions.
The report contributes to the strategic situational awareness of a growing problem, the exposure of account credentials in ways enabling adversaries to gain unauthorized access to enterprise resources.

Google Apps Assassinated My Domain – BEWARE!

MattDevost November 23, 2012

I’ve been a long-time user of Google Apps and have recommended it to dozens of colleagues and associates. I currently use both the Standard (free) and Enterprise (paid) version of apps for several very high profile and long-standing domains. I’ve always considered it to be a reliable and cost-effective option for providing core email, calendar, and other services. However, I’ve recently fallen victim to activity by Google that demonstrates how an enterprise is placing their operations at risk if using Google Apps for their domain.

The first indication that there was a problem was an error message on my iPhone indicating that the password was incorrect for the domain in question. Since the password hadn’t been changed recently, I decided to investigate from my desktop by trying to log into the account. I was greeted with a message that stated “This account has been disabled” and a recommendation to change my password if I was having problems.

I followed the process for changing the password successfully and attempted to log in again. “This account has been disabled.” I consulted Google and found no helpful forum or blog postings on how to resolve this issue. I searched for a way contact Google associated with this issue. No luck. There is an option to obtain dial-in support, but that requires access to your account PIN and since I couldn’t log into the Apps admin panel, I couldn’t obtain the PIN. If you call Google Apps support, there is no way to proceed without the PIN.

I decided to post a message on the support forum for Google Apps. After ten days, there were no replies from other users or “advisors” from Google despite my attempt to bump the thread.

So let’s recap the impact to the domain after more than 7 days:

No email – not only could I not send and receive email, when folks tried to email me they got a hard bounce (account disabled). It is one thing to disable access to email, but bouncing email is catastrophic as communications completely fail instead of being queued in the inbox until the issue is resolved.

No App services – Calendar, Docs, Drive, and all Google App services are completely blocked. These are not critical for this domain in particular, but would be high impact if denied for some of my other domains.

Things were starting to get desperate. What could I do to restore email? Migrate the MX entries to another provider?

Ninety-six hours later, still no resolution. I’ve deliberately delayed migrating to another service provider so that I could provide an accurate perspective and timeline for this blog post, but it would appear that Google had successfully denied service to the business with no way to seek resolution.

I’d searched my email for this domain and the back-up email associated with the domain. There had been no correspondence from Google indicating an issue with the domain or an attempt to notify me of an impending or enacted disabling of the account. Google App services on the domain were killed with no explanation and no recourse.

In desperation, I decided to try and social engineer my way to support. I dialed in and entered the PIN from another one of my domains and once I got a human on the phone explained my issue. They promised they would look into it and call me in a few hours. I gave them my home and mobile numbers and made them promise to call back before hanging up. You guessed it, no call back. During that dial-in process, I was able to get a trouble-ticket issued so after a day I emailed Google Apps support in reference to that trouble ticket. Within a few days I had elevated it to a senior support person who suddenly emailed me a resolution:

“I have reviewed you case and can see that your account was incorrectly disabled due to an internal issue which our technical team has now resolved.

Therefore I have gone ahead and re-enabled your account and you should now be able to log in to use Google Apps.

I am sorry for the inconvenience caused. I understand that you were without access to the Google Apps services and I really appreciate your patience whist we have worked through this issue.”

The problem is now fixed, but not without significant impact to the domain in question and no explanation from GOogle as to how an “internal issue” can disable a business for over a week.

If you are currently using Google Apps for your domain, or considering the service, I would recommend you be aware that you are placing your livelihood in the hands of Google, which has no incentive to provide reliable services or support. Google can disable your domain services at their sole discretion with no recourse other than to move to an alternative service provide and social engineer a resolution that took over a week to resolve.

I’ll be looking at Rackspace and Microsoft as alternative service providers and appreciate any recommendations you may have regarding your experiences with those services.

UPDATE – NOVEMBER 25 2012

There has been a lot of great discussion regarding this article here on CTOVision and at HackerNews. As promised, here are some hints and recommendations on how to resolve this issue or at least plan for minimizing the impact to operations.

Things Google should do:

1) Alert the user at their secondary address if domain services are disabled with a time-expiring dynamic link to generate a trouble-ticket if this is in error. As a provider of services (even free) Google is obligated to at least try and ensure that services are not disabled due to an error on their end. Remember, even with free services, you are paying Google with your user data!

2) Allow a secondary mechanism for obtaining the support PIN in the event the admin panel is inaccessible. Perhaps they have you generate a TXT record in your domain DNS that once verified sends and email to the back-up domain email with your customer number and support PIN.

If you are the domain administrator:

1) Store your support PIN in a secure location outside of the Google ecosystem. I’m a big fan of using 1Password for this type of content, but a piece of paper in a safe would work just as well. You need to plan for not having access to your Admin panel.

2) Ensure your DNS is hosted outside of Google. Most registrars provide free DNS services, but I’m also a huge fan of Amazon Route 53. You need to be able to change your MX record to another email provider if the outage becomes unacceptable.

3) Establish a secondary provider in advance so you can hot-swap if you need to. This step may be cost prohibitive to some, but worth determining if the several hundred dollars per year is reasonable insurance in the event your Google services are disabled. For critical accounts, forward the email to the secondary provider account so you have a back-up of the email content as well.

4) Consider purchasing Google Apps through a reseller. Resellers have experience and access to support that normal “small” enterprise users don’t have. It might be worth having that reseller relationship in the event you have an issue like this.

5) There is a way to generate a Support Ticket in a circumstance like this, it is just hidden behind several layers. I was able to discover it through my conversations with Google, so if you are having this issue here is what I recommend.

On your Google Apps login page, select the link that says “Can’t access your account.”
Upon solving the Captcha on the next page look for a link that says “Reset your administrator password by domain verification”
On the next page, enter a valid email address.
On the following page, under item 3, you’ll see a link to contact Google support. That link is

https://support.google.com/a/bin/request.py?contact_type=admin_no_access

As of the date of this update, you can navigate directly to that link to generate a support ticket.

Public-Private Information Sharing and Lessons for the Government CIO/CTO

Bob Gourley November 21, 2012

Public-Private Information Sharing, or a varient of that concept, has been a part of federal government strategic plans for as long as I can remember. Every cyber security related study I know of, including the famous 1966 President’s Commission on Critical Infrastructure Protection, has made public-private information sharing a key strategy. Federal agencies and studies have made important suggestions regarding public-private information sharing part of most every major IT study. I’ve seen this type of information sharing work very well, but as a technologist I’ve also seen a need for (and urged) improvements to the model.

For example, too frequently the way government executives are forced to do public-private information sharing is through processes that flow from the Federal Acquisition Regulations (FAR). The FAR mandates market assessments and surveys to be done in ways that do not give one company an unfair advantage over another. This is smart of course, but results in some industrial age information gathering that is not very timely.

Federal technologists also do quite a bit of direct coordination with industry to learn and they do this under the watchful eye of procurement executives to make sure this is all above board, and this sort of coordination with industry technologists is absolutely critical to the smooth functioning of federal enterprises. The executives in DC who make trips to Silicon Valley or great hubs of innovation like Boston or Raleigh or Boulder (home of WayIn) come back with information that can help their strategic planning and this sort of public-private info exchange also helps industry know important things about government mission needs.

But too frequently government is tempted to just ask their local industry reps for info and advice on the future of technology. This is still public-private info sharing, and when budgets get tight is can be incredibly cost effective to just turn to a favored federal systems integrator that you already have on contract and ask them questions and consider this your public-private information exchange. There are many great integrators in the DC area and I know and love them but this is not optimal long term, since most integrators serving government become captured by government and talking to them is almost like talking to yourself.

There are also many non profit collegial organizations and consortia in the federal space that government frequently turns to for public-private information sharing and coordination. These include many great organizations that I volunteer time with, like the Intelligence and National Security Alliance (INSA), the Armed Forced Computer and Electronics Association (AFCEA), and the National Defense Industrial Association (NDIA). I volunteer with these groups because I love them and strongly support the positive change they make in the world. But when government turns to these groups for their public-private information exchange it is sub-optimized. They are full of people like me, former government executives who might be easy to talk with but who might not be as up to date with the best information industry has to offer.

Some lucky few government technologists get to interact with In-Q-Tel, a collective of very savvy technology and business professionals who absolutely master the art of surveying industry for best technology. The entire government would be well served if this model were replicated for all. But for now In-Q-Tel cannot serve the entire federal space. And it also serves mostly in the new technology space, not in areas like process, procedure and lessons learned exchanges. In-Q-Tel is only part of a solution.

I always recommend to government friends that they make the most of the great resources American industry has to offer and that includes learning from locals in the DC ecosystem but should also include a program of focused interaction with others far from DC. You will make great friends doing this and the connections you make can turn into long term trust-based relationships that can help both the government and American industry advance. Time is precious to all of us, so government executives need to plan how this is done wisely, but periodic visits to the champions of industry like Oracle, Microsoft, IBM, Apple, HP, VMware, EMC, Cloudera, Cleversafe, Terracotta, AT&T and the great Venture Capital and Private Equity firms for reviews of their portfolios are critically important. I’ve also been so fortunate in my career to have spent time with chip makers, security firms, and even great institutions like Disney. It is all a learning experience.

Direct interaction is best for these long term trust based relationships, but when that is hard you can also meet industry online. One great place to do that is through venues like the Enterprise CIO Forum. Since this is a forum backed by CXO Media (the parent company of CIO magazine) it is a well resourced venue that includes a world class community manager (John Dodge). If you are a CTO or CIO in the federal space you probably already read CIO Magazine. Why not join the Enterprise CIO Forum to interact directly with people from outside the federal ecosystem?

Changing Government Requirement For Market Research to Continuous Market Assessment

Thoughts on the Government Shutdown: from a technologist perspective

The Role of the CTO: Four Models for Success

Global Cyber Alliance Release: Perhaps the most important of the 2018 RSA Conference Season

MicroSoft Fields Self Learning AI That Quickly Learns To Be Rude, Sexist and Racist

The Global Cyber Alliance Appoints Philip Reitinger as its First President and CEO