Loss Of Cyber Expertise Is A Problem For Trump

The Trump administration has lost a handful of individuals serving in top cybersecurity roles across the federal government in recent weeks, even as it has struggled to fill top IT positions.

The developments present hurdles for the new administration and speaks to the longstanding challenge the federal government faces in competing with the private sector for top tech talent.

Among those resigning is Richard Staropoli, a former US Secret Service agent who served as chief information officer (CIO) of the Department of Homeland Security for just three months before announcing abruptly that he would leave.

Staropoli, who as recently as June forecast big plans to reorganize the department’s information technology office, will officially leave the post at the start of September, turning the role over to his deputy on a temporary basis.

The Office of Personnel Management (OPM) is also about to lose its top IT official, with news that CIO Dave DeVries has resigned from his position and will leave in September after about a year on the job.

OPM has been under intense scrutiny from lawmakers and others since 2015, when it was revealed that a breach of its data systems resulted in personal information on more than 21 million Americans being exposed to Chinese hackers.

A spokesperson for the agency confirmed DeVries’s resignation, which was first reported last week, attributing his decision to family considerations. OPM does not yet have information on who will serve as interim or acting CIO, the spokesperson said.

On Friday 18th August, the Navy lost its CIO.

However, Rob Foster, who has served in the role for more than two years, is transitioning to another role in the federal government, moving to fill the deputy CIO role at the National Credit Union Administration.

The cyber-security coordinator for President Obama’s White House said the administration can survive the turnover, but that it could cause long-term problems.

“As a general rule, the immediate departure of a few individuals is not going to make a difference in the federal government’s overall vulnerability over the short term,” said Obama cybersecurity coordinator Michael Daniel.

“When you have personnel vacancies at the top, the impact is felt on long-term cyber-security efforts and incident response,” he said. “For the first, you don’t have someone to drive the needed policy changes and oversee implementation. For the second, you don’t have a leader to manage the response efforts.”

The Environmental Protection Agency’s chief information security officer (CISO) is also reportedly stepping down this month. Sean Kelley, who has been on the job since January, is said to be taking a position at the IT and defense company Leidos. The agency did not return a request for confirmation of his resignation.

Experts say the longer these positions remain unfilled, the tougher it will be to enact policy changes, including those laid out in President Trump’s executive order on strengthening cyber-security signed in May.

“It can really paralyse an organisation until new leadership [arrives],” said James Norton, who served in a cyber-security role at the Department of Homeland Security during the George W. Bush administration.

Specific authorities of CIOs range from agency to agency, though they are broadly tasked with overseeing policy and security decisions when it comes to their individual government body’s IT infrastructure. Some CIOs are political appointments, while others are not.

Several occupants of these positions are currently serving on an acting basis, including those at the Departments of Commerce, Transportation and Veterans Affairs and the Environmental Protection Agency.

“It is definitely incumbent on the administration to have every position filled by the end of the year,” said Norton. “If they’re not able to do that, I think that’s troubling.”

Trump has made some progress filling federal cybersecurity-related roles. White House homeland security adviser Tom Bossert, on board since the start of the administration, is widely credited with spearheading Trump’s cybersecurity executive order.

The administration has also brought on Rob Joyce, a former National Security Agency official, to manage the federal government’s cybersecurity policy efforts at the National Security Council.

However, the administration has yet to permanently fill the roles of federal CIO and federal CISO within the Office of Management and Budget. Grant Schneider, the deputy federal CISO, has been filling the role of acting federal CISO since his boss left in January. CyberScoop reported last week that Schneider will also fulfill a cyber-security role at the NSC in the interim, taking on two jobs at once.

The White House is also said to have fired the CISO for the Executive Office of the President, Cory Louie, back in February.

Jason Healey, a cyber-security expert and senior research scholar at Columbia University’s School for International and Public Affairs, noted other “critical” cybersecurity job openings across the government, including the recently vacated cyber-security diplomacy coordinator role at the State Department.

“The loss of these senior officials is not promising, of course. But they’re generally only looking after their own agencies, not the larger federal enterprise or national cyber-security,”

Healey said of the recent departures in an email. “I’m most concerned that two of them had only recently joined will send danger signals for talented people looking who might want to serve in government.”

CIOs encompass just one of several leading technology roles in the federal government, a growing group that also includes CISOs, chief technology officers, chief data officers and chief innovation officers. The federal IT workforce encompasses more than 80,000 individual employees.

The federal government has long faced a challenge of competing with the private sector to recruit and retain top-tier tech talent.

But Daniel, the Obama cyber czar, surmised that the Trump administration could face an even tougher recruitment challenge because of its lack of organisation and the perception of a White House embroiled in chaos.

“I suspect that has very little to do why an individual CIO at an agency might leave, but it certainly is going to add to their recruiting challenges,” Daniel said.

“It’s a challenge in any administration, and that’s if you have a big apparatus ready to go,” Daniel said. “If you don’t have that, it makes it even more challenging.”

The Hill

You Might Also Read: 

Top US Cyber Official Resigns:

« Fighting Digital Crime: Evolving Police Methods
Artificial Intelligence: A Warning »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Defense Advanced Research Projects Agency (DARPA)

Defense Advanced Research Projects Agency (DARPA)

DARPA's mission is to develop breakthrough technologies for national security. The Information Innovation Office undertakes cyber security activities.

CIO

CIO

CIO provides technology and business leaders with insight and analysis on information technology trends

Security Research Labs (SRLabs)

Security Research Labs (SRLabs)

Security Research Labs is a Berlin-based hacking research collective and consulting think tank.

aeCERT

aeCERT

aeCERT is the national Computer Emergency Response Team for the United Arab Emirates.

Snyk

Snyk

Snyk is the leader in developer security. We empower the world’s developers to build secure applications and equip security teams to meet the demands of the digital world.

SOCOTEC Certification International

SOCOTEC Certification International

SOCOTEC Certification International has been providing management systems assessment and accredited ISO certification services to organisations around the world since 1995.

Veriff

Veriff

Veriff provides highly-automated identity-verification services that prevent fraud like nothing else on the market.

Osirium

Osirium

The Osirium PxM Privileged Access Management platform addresses both security and compliance requirements by defining who gets access to what and when.

Apozy

Apozy

Apozy replaces a secure web gateway to nullify phishing, malware and impersonation attacks.

Greylock Partners

Greylock Partners

Greylock Partners is a leading venture capital firm based in Silicon Valley. We invest in all sectors of enterprise software technology including applications, cloud/SaaS, networking and security.

Ridge Canada Cyber Solutions

Ridge Canada Cyber Solutions

Ridge Canada helps insurance brokers and insurance buyers understand, evaluate, and secure cyber coverage that is tailored to their business.

Truvantis

Truvantis

Truvantis is a cybersecurity consulting organization providing best-in-class cybersecurity services to secure your organization’s infrastructure, data, operations and products.

Logiq Consulting

Logiq Consulting

Logiq Consulting provide a full range of Cyber Security, Information Assurance and System Engineering services.

Arculus Cyber Security

Arculus Cyber Security

Arculus Cyber Security enables customers to securely realise the benefits of digital transformation through pragmatic solutions, guidance and services.

Trium Cyber

Trium Cyber

Trium Cyber - Expert Cyber Underwriting and Claims Management. Based in the US and UK. Backed by Lloyd’s of London.

Blackmere Consulting

Blackmere Consulting

Blackmere Consulting is a Nationwide Technical and Executive Recruiting firm dedicated to Cyber Security and Information Technology.