Loss Of Cyber Expertise Is A Problem For Trump

The Trump administration has lost a handful of individuals serving in top cybersecurity roles across the federal government in recent weeks, even as it has struggled to fill top IT positions.

The developments present hurdles for the new administration and speaks to the longstanding challenge the federal government faces in competing with the private sector for top tech talent.

Among those resigning is Richard Staropoli, a former US Secret Service agent who served as chief information officer (CIO) of the Department of Homeland Security for just three months before announcing abruptly that he would leave.

Staropoli, who as recently as June forecast big plans to reorganize the department’s information technology office, will officially leave the post at the start of September, turning the role over to his deputy on a temporary basis.

The Office of Personnel Management (OPM) is also about to lose its top IT official, with news that CIO Dave DeVries has resigned from his position and will leave in September after about a year on the job.

OPM has been under intense scrutiny from lawmakers and others since 2015, when it was revealed that a breach of its data systems resulted in personal information on more than 21 million Americans being exposed to Chinese hackers.

A spokesperson for the agency confirmed DeVries’s resignation, which was first reported last week, attributing his decision to family considerations. OPM does not yet have information on who will serve as interim or acting CIO, the spokesperson said.

On Friday 18th August, the Navy lost its CIO.

However, Rob Foster, who has served in the role for more than two years, is transitioning to another role in the federal government, moving to fill the deputy CIO role at the National Credit Union Administration.

The cyber-security coordinator for President Obama’s White House said the administration can survive the turnover, but that it could cause long-term problems.

“As a general rule, the immediate departure of a few individuals is not going to make a difference in the federal government’s overall vulnerability over the short term,” said Obama cybersecurity coordinator Michael Daniel.

“When you have personnel vacancies at the top, the impact is felt on long-term cyber-security efforts and incident response,” he said. “For the first, you don’t have someone to drive the needed policy changes and oversee implementation. For the second, you don’t have a leader to manage the response efforts.”

The Environmental Protection Agency’s chief information security officer (CISO) is also reportedly stepping down this month. Sean Kelley, who has been on the job since January, is said to be taking a position at the IT and defense company Leidos. The agency did not return a request for confirmation of his resignation.

Experts say the longer these positions remain unfilled, the tougher it will be to enact policy changes, including those laid out in President Trump’s executive order on strengthening cyber-security signed in May.

“It can really paralyse an organisation until new leadership [arrives],” said James Norton, who served in a cyber-security role at the Department of Homeland Security during the George W. Bush administration.

Specific authorities of CIOs range from agency to agency, though they are broadly tasked with overseeing policy and security decisions when it comes to their individual government body’s IT infrastructure. Some CIOs are political appointments, while others are not.

Several occupants of these positions are currently serving on an acting basis, including those at the Departments of Commerce, Transportation and Veterans Affairs and the Environmental Protection Agency.

“It is definitely incumbent on the administration to have every position filled by the end of the year,” said Norton. “If they’re not able to do that, I think that’s troubling.”

Trump has made some progress filling federal cybersecurity-related roles. White House homeland security adviser Tom Bossert, on board since the start of the administration, is widely credited with spearheading Trump’s cybersecurity executive order.

The administration has also brought on Rob Joyce, a former National Security Agency official, to manage the federal government’s cybersecurity policy efforts at the National Security Council.

However, the administration has yet to permanently fill the roles of federal CIO and federal CISO within the Office of Management and Budget. Grant Schneider, the deputy federal CISO, has been filling the role of acting federal CISO since his boss left in January. CyberScoop reported last week that Schneider will also fulfill a cyber-security role at the NSC in the interim, taking on two jobs at once.

The White House is also said to have fired the CISO for the Executive Office of the President, Cory Louie, back in February.

Jason Healey, a cyber-security expert and senior research scholar at Columbia University’s School for International and Public Affairs, noted other “critical” cybersecurity job openings across the government, including the recently vacated cyber-security diplomacy coordinator role at the State Department.

“The loss of these senior officials is not promising, of course. But they’re generally only looking after their own agencies, not the larger federal enterprise or national cyber-security,”

Healey said of the recent departures in an email. “I’m most concerned that two of them had only recently joined will send danger signals for talented people looking who might want to serve in government.”

CIOs encompass just one of several leading technology roles in the federal government, a growing group that also includes CISOs, chief technology officers, chief data officers and chief innovation officers. The federal IT workforce encompasses more than 80,000 individual employees.

The federal government has long faced a challenge of competing with the private sector to recruit and retain top-tier tech talent.

But Daniel, the Obama cyber czar, surmised that the Trump administration could face an even tougher recruitment challenge because of its lack of organisation and the perception of a White House embroiled in chaos.

“I suspect that has very little to do why an individual CIO at an agency might leave, but it certainly is going to add to their recruiting challenges,” Daniel said.

“It’s a challenge in any administration, and that’s if you have a big apparatus ready to go,” Daniel said. “If you don’t have that, it makes it even more challenging.”

The Hill

You Might Also Read: 

Top US Cyber Official Resigns:

« Fighting Digital Crime: Evolving Police Methods
Artificial Intelligence: A Warning »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

eScan AV

eScan AV

eScan develops Information Security solutions that provide protection against current and evolving cyber threats.

StoneFly

StoneFly

StoneFly offers High Availability, high performance cluster and scale out storage, and backup and disaster recovery appliances.

Wibu-Systems

Wibu-Systems

Wibu-Systems is a leading provider of solutions for the Digital Rights Management (DRM) and anti-piracy industry.

CalCom

CalCom

CalCom Hardening Solution (CHS) for Microsoft OMS is a security baseline-hardening solution designed to address the needs of IT operations and security teams.

File Centre

File Centre

File Centre is a leading specialist when it comes to data backup, we offer our clients a premium backup retrieval and delivery solution.

Intrinsyc Technologies

Intrinsyc Technologies

Intrinsyc provides product development services and Edge Computing modules that are helping to take the Internet of Things products to the next level.

Towerwall

Towerwall

Towerwall offers a comprehensive suite of security services and solutions using best-of-breed tools and information security services.

GovernmentCIO

GovernmentCIO

GovernmentCIO was founded with a single purpose: to transform government IT. We are thought leaders in data analytics, machine learning, cybersecurity and IT transformation.

US Digital Corps

US Digital Corps

The U.S. Digital Corps is a new two-year fellowship for early-career technologists where you will work every day to make a difference in critical impact areas including cybersecurity.

Appsec Phoenix

Appsec Phoenix

Appsec Phoenix is an end to end vulnerability management platform that focuses on workflows, threat feed, and real time data.

Mosaic Insurance

Mosaic Insurance

Mosaic is a next-generation global specialty insurer distinguished by an exceptional team, agile technology, and a structure that combines Lloyd’s of London strength with a global distribution network

Sencode Cyber Security

Sencode Cyber Security

Sencode provides a range of IT security solutions and services, including penetration testing and cyber awareness training to help mitigate the growing risks to your corporate infrastructure.

Coffee Cup Solutions

Coffee Cup Solutions

We offer a full spectrum of IT Services, from our UK based Helpdesk to IT Consultancy and Cyber Security. Our team has the skills and experience to develop, deliver and manage IT for your business.

Cyber Proud

Cyber Proud

Cyber proud is leading a talent revolution to promote and create an inclusive skilled cyber workforce.

CipherStash

CipherStash

CipherStash is a complete data governance and breach prevention platform.

Ventum Consulting

Ventum Consulting

Ventum Consulting stands for digitalization, networking and agilization. We take this up on the strategic, professional and technical side and support our customers in the digital transformation.