Loss Of Cyber Expertise Is A Problem For Trump

The Trump administration has lost a handful of individuals serving in top cybersecurity roles across the federal government in recent weeks, even as it has struggled to fill top IT positions.

The developments present hurdles for the new administration and speaks to the longstanding challenge the federal government faces in competing with the private sector for top tech talent.

Among those resigning is Richard Staropoli, a former US Secret Service agent who served as chief information officer (CIO) of the Department of Homeland Security for just three months before announcing abruptly that he would leave.

Staropoli, who as recently as June forecast big plans to reorganize the department’s information technology office, will officially leave the post at the start of September, turning the role over to his deputy on a temporary basis.

The Office of Personnel Management (OPM) is also about to lose its top IT official, with news that CIO Dave DeVries has resigned from his position and will leave in September after about a year on the job.

OPM has been under intense scrutiny from lawmakers and others since 2015, when it was revealed that a breach of its data systems resulted in personal information on more than 21 million Americans being exposed to Chinese hackers.

A spokesperson for the agency confirmed DeVries’s resignation, which was first reported last week, attributing his decision to family considerations. OPM does not yet have information on who will serve as interim or acting CIO, the spokesperson said.

On Friday 18th August, the Navy lost its CIO.

However, Rob Foster, who has served in the role for more than two years, is transitioning to another role in the federal government, moving to fill the deputy CIO role at the National Credit Union Administration.

The cyber-security coordinator for President Obama’s White House said the administration can survive the turnover, but that it could cause long-term problems.

“As a general rule, the immediate departure of a few individuals is not going to make a difference in the federal government’s overall vulnerability over the short term,” said Obama cybersecurity coordinator Michael Daniel.

“When you have personnel vacancies at the top, the impact is felt on long-term cyber-security efforts and incident response,” he said. “For the first, you don’t have someone to drive the needed policy changes and oversee implementation. For the second, you don’t have a leader to manage the response efforts.”

The Environmental Protection Agency’s chief information security officer (CISO) is also reportedly stepping down this month. Sean Kelley, who has been on the job since January, is said to be taking a position at the IT and defense company Leidos. The agency did not return a request for confirmation of his resignation.

Experts say the longer these positions remain unfilled, the tougher it will be to enact policy changes, including those laid out in President Trump’s executive order on strengthening cyber-security signed in May.

“It can really paralyse an organisation until new leadership [arrives],” said James Norton, who served in a cyber-security role at the Department of Homeland Security during the George W. Bush administration.

Specific authorities of CIOs range from agency to agency, though they are broadly tasked with overseeing policy and security decisions when it comes to their individual government body’s IT infrastructure. Some CIOs are political appointments, while others are not.

Several occupants of these positions are currently serving on an acting basis, including those at the Departments of Commerce, Transportation and Veterans Affairs and the Environmental Protection Agency.

“It is definitely incumbent on the administration to have every position filled by the end of the year,” said Norton. “If they’re not able to do that, I think that’s troubling.”

Trump has made some progress filling federal cybersecurity-related roles. White House homeland security adviser Tom Bossert, on board since the start of the administration, is widely credited with spearheading Trump’s cybersecurity executive order.

The administration has also brought on Rob Joyce, a former National Security Agency official, to manage the federal government’s cybersecurity policy efforts at the National Security Council.

However, the administration has yet to permanently fill the roles of federal CIO and federal CISO within the Office of Management and Budget. Grant Schneider, the deputy federal CISO, has been filling the role of acting federal CISO since his boss left in January. CyberScoop reported last week that Schneider will also fulfill a cyber-security role at the NSC in the interim, taking on two jobs at once.

The White House is also said to have fired the CISO for the Executive Office of the President, Cory Louie, back in February.

Jason Healey, a cyber-security expert and senior research scholar at Columbia University’s School for International and Public Affairs, noted other “critical” cybersecurity job openings across the government, including the recently vacated cyber-security diplomacy coordinator role at the State Department.

“The loss of these senior officials is not promising, of course. But they’re generally only looking after their own agencies, not the larger federal enterprise or national cyber-security,”

Healey said of the recent departures in an email. “I’m most concerned that two of them had only recently joined will send danger signals for talented people looking who might want to serve in government.”

CIOs encompass just one of several leading technology roles in the federal government, a growing group that also includes CISOs, chief technology officers, chief data officers and chief innovation officers. The federal IT workforce encompasses more than 80,000 individual employees.

The federal government has long faced a challenge of competing with the private sector to recruit and retain top-tier tech talent.

But Daniel, the Obama cyber czar, surmised that the Trump administration could face an even tougher recruitment challenge because of its lack of organisation and the perception of a White House embroiled in chaos.

“I suspect that has very little to do why an individual CIO at an agency might leave, but it certainly is going to add to their recruiting challenges,” Daniel said.

“It’s a challenge in any administration, and that’s if you have a big apparatus ready to go,” Daniel said. “If you don’t have that, it makes it even more challenging.”

The Hill

You Might Also Read: 

Top US Cyber Official Resigns:

« Fighting Digital Crime: Evolving Police Methods
Artificial Intelligence: A Warning »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Riverbed Technology

Riverbed Technology

The Riverbed Network and Application Performance Platform enables organizations to visualize, optimize, accelerate and remediate the performance of any network for any application.

Datiphy

Datiphy

Datiphy's data-centric security platform uses behavioral analytics, and data-centric auditing and protection capabilities to mitigate risk.

Maritime Cybersecurity Center (MCC)

Maritime Cybersecurity Center (MCC)

Maritime Cybersecurity Center is a not-for-profit organization focused on regional cybersecurity excellence and readiness, with a special emphasis on the maritime community.

4Stop

4Stop

4Stop is a global KYC, compliance and anti-fraud risk management company.

CYE

CYE

Utilizing data, numbers, and facts, CYE helps security leaders know what business assets are at risk and execute cost-effective remediation projects for optimal risk prevention.

Kymatio

Kymatio

Kymatio are pioneers in Artificial Intelligence applied to adaptive staff strengthening, cultural change and predictive internal risk analysis.

Finnish Accreditation Service (FINAS)

Finnish Accreditation Service (FINAS)

FINAS is the national accreditation body for Finland. The directory of members provides details of organisations offering certification services for ISO 27001.

Stratus Cyber

Stratus Cyber

Stratus Cyber is a premier Cyber Security company specializing in Managed Security Services. Our services include Blockchain Security, Pentesting, and Compliance Assessments.

SOSA

SOSA

SOSA facilitates new growth opportunities by connecting the dots between industry verticals and innovation ecosystems around the world.

Corsha

Corsha

Corsha is on a mission to simplify API security and allow enterprises to embrace modernization, complex deployments, and hybrid environments with confidence.

US Army Cyber Command (ARCYBER)

US Army Cyber Command (ARCYBER)

US Army’s Cyber Command (ARCYBER) is engaged in the real-world cyberspace fight today, against near-peer adversaries, ISIS, and other global cyber threats.

Stripe OLT

Stripe OLT

At Stripe OLT, we provide complete business technology solutions - Our team has an unrivalled reputation as a Microsoft Gold Partner, specialising in secure, cloud-first technology.

Com Olho

Com Olho

Com Olho provides the measurement, analytics, quality assurance, and fraud protection technologies brands need for their business and customers.

SIGLA Group

SIGLA Group

SIGLA Group specialize in the design and development of IT and OT solutions, from analysis to design, from implementation to commissioning, as well as consultancy, training and assistance.

Icon Information Systems (ICONIS)

Icon Information Systems (ICONIS)

ICONIS is an integrated infrastructure and service provider, offering unified Information Technology (IT) solutions globally.

Access Talent Today

Access Talent Today

Access Talent Today is an AI/ML and cyber security talent provider.

Prizsm Technologies

Prizsm Technologies

Prizsm is a computational storage capability that provides flexible, easy-to-use, resilient solutions for quantum-resistant, hyper-secure cloud storage and communications.