John Sutherland

This week in Defense Tech: 1️⃣ US Army Gives Update on Generative Artificial Intelligence and Large Language Models. The experiment focused on data collected through Project Athena. 2️⃣ The DON PEO Digital Neptune Cloud Management Office (CMO) successfully onboarded the first mission owner into its Flank Speed Azure IL6 environment. 3️⃣ Defense Information Systems Agency announces the Joint Warfighting Cloud Capability has surpassed $1 billion in total lifecycle value with over 65 task orders awarded to various organizations across the United States Department of Defense. 4️⃣ Palantir Technologies’s CTO, is determined to help Palantir become a driving force for defense tech startups, a sector that’s been flooded with over  $129.3 billion in venture capital since 2021, according to PitchBook. 5️⃣ FedRAMP has a permanent director for first time in 3 years. Peter Waterman is the director of the cloud security program, known as FedRAMP, after stints with USDS and the Technology Modernization Fund. 6️⃣ FedRAMP is launching the Digital Authorization Package pilot. The primary goal of the pilot is to improve the FedRAMP digital authorization package guidance and validation tooling while helping CSPs prepare high-quality system security plans in OSCAL. 7️⃣ United States Department of Defense releases key CMMC contracting rules. The CMMC requirements will feature a three-year "phased rollout," as the Pentagon continues to move forward with the massive cyber certification scheme. 8️⃣ War on the Rocks posts a perspectives on how to make military AI governance more robust. From the backroom to the battlefield, AI is now being integrated into the full spectrum of military operations, including in logistics, intelligence collection, wargaming, decision-making, target identification, and weapons systems, with increasing levels of autonomy. 9️⃣ Defense Information Systems Agency mulls adding vendors, different contract types for JWCC 2.0. Lt. Gen. Robert Skinner said JWCC 2.0 will bring faster commercial cloud capability and "greater diversity." 🔟 Pentagon accepting video pitches from vendors looking to gain access to CJADC2 enterprise. The DoD Chief Digital and Artificial Intelligence Office and AI Office is accepting submissions for its inaugural "challenge" to industry. 🔗 Links in comments below 👇 #DoD #DHS #defenseinnovation #defense #defensetechnology #technology #tech #nationalsecurity #jadc2 #army #navy #airforce

11

10 Comments

MBA school is a great way for transitioning veterans to take dedicated time to find the best next steps for them and launch a new career! This conference has lots of excellent opportunities for veterans at top ranked MBA schools. Reach out if you’d like to hear my experience! #mbaveterans #veteranshelpingveterans

6

1 Comment

Interested in #AI or Autonomous Systems? Then check out this article by Axios on my company's CINO.

6

Building networks with military, civilian, and intelligence community leaders is just part of AJ’s day-to-day as the Business Development Executive for the Varonis Department of Defense team. Learn the ins-and-outs of AJ's day-to-day in this episode of Speed Data! #Cybersecurity #DataSecurity #FederalGovernment

3

🚀 Proud Moment Alert! 🚀 The USPTO team integrated Sonatype solutions and revolutionized their approach to software development. By automating the nitty-gritty parts of the #softwaredevelopmentlifecycle, they’re not just keeping pace with technology—but leading the charge in IT innovation. Curious about their journey and how we're tackling challenges with #opensource dependencies head-on? Dive into our story 👉 https://bit.ly/4aSrCz2

13

A thoughtful piece on the risks of using LLMs in the DoD, most of which applies to any enterprise. I will share a few comments. EAI is mostly about precision data management, which the DoD has struggled with for decades at the enterprise level. Countless efforts have been made, many really good people have contributed, also many incompetent people, some who were corrupt, and hundreds of billions of dollars spent -- a significant portion of which was wasted. At the unit level the DoD has done much better, but unfortunately in a modern war -- not unlike in business, enterprise-wide functionality is critical, particularly during a large-scale war, and one can't install even the most elegantly designed systems at that scale overnight. Essentially the DoD should forget LLMs and focus on EAI. With the right system in place LLMs would be properly applied and compartmentalized to optimize productivity and mitigate risks. In addition, the DoD and USG should not be infringing on copyright as a matter of principle, and frankly doesn't need to. The DoD has plenty of data to run GenAI wisely, with the right system. The biggest problem by far is the DoD and USG are like conjoined twins with Big Tech. As one of my advisers said recently who spent career in the DoD "the DoD and IC don't work with startups", even though we know the best innovation usually comes from small, new, authentic inventors. Part of the reason is indoctrination into the myth that ever-bigger U.S. tech companies are aligned with U.S. national security interests, when just the opposite is true. That is partially driven by another reason, which is much of the workforce of the DoD (and USG) are there for career security, not to make the most impact, and a large number want nothing more than to work for Big Tech companies. Solving this problem will require more than just more money and a never-ending PR effort calling for internal reforms at the DoD. It will require new laws that substantially end the toxic revolving door syndrome. I'm not suggesting an outright ban, but I am saying that the USG has been corrupted by Big Tech in a similar manner to academia. We need rational restrictions. ~~~~~ Quote: In a different research project, we studied how LLMs behaved within simulated war games, specifically focusing on whether they chose to escalate. The study, which compared LLMs from leading Silicon Valley companies such as Anthropic, Meta, and OpenAI, asked each LLM to play the role of a country, with researchers varying the country’s goals. We found that the LLMs behaved differently based on their version, the data on which they were trained, and the choices that their designers made during fine-tuning about their preferences. Despite these differences, we found that all these LLMs chose escalation and exhibited a preference toward arms races, conflict, and even the use of nuclear weapons.

7

1 Comment

would like to see a little bit more stick, but its a start (still a slow process) Receiving AOs have the right to refuse participating in reciprocity with another organization due to insufficient content demonstrating an informed understanding of the security posture, risk assessment of the system, and the rationale for the risk determination as defined on the RMF KS, or due to excessive risk to the enclave or site, as determined by the site AO. However, the Receiving AO must document and report this refusal to the Granting organization’s AO within 10 business days. If a refusal does occur, both organizations will continue to work, and re-work, the ATO package to reach an agreement, if at all possible. When AOs cannot reach an agreement to leverage re-use and reciprocity, both parties must use the following resolution process to gain assistance in resolving the impasse: 1. If a conflict arises, due to reciprocity refusal there should be an attempt to resolve it at the AO level. This could include, but not limited to, the Granting AO conducting new assessments. 2. If the conflict cannot be resolved at the AO level, the RMF TAG Secretariat will be notified and the RMF TAG Chair will attempt to mediate the dispute as appropriate. 3. If the RMF TAG Chair cannot reach a resolution, the issue will be taken to the AO Council, chaired by the DoD CISO, who will serve as a mediator for the dispute. 

20

It took me a couple of years working with the DoD before I realized that there are two competing definitions of DevSecOps in wide use. In this post, I explain the two, how I think we got here, the problems we’re facing, and how can easily address fix the bug.

16

2 Comments

🇺🇸🆔 U.S. Department of Homeland Security (DHS) Awards Contracts to Innovate Digital Credential Privacy The DHS Science and Technology Directorate (S&T) has announced government contracts awarded to Credence ID, Hushmesh, Netis d.o.o., Procivis, SpruceID, and Ubiqu. These contracts are aimed at developing privacy-enhanced technologies for digital versions of credentials used in immigration and travel, allowing users to store their information securely in digital wallets. Anil John, Technical Director of S&T’s Silicon Valley Innovation Program (SVIP), emphasized the importance of these developments, stating that the new capabilities will ensure secure storage and proper verification of credentials while preserving individual privacy. This initiative supports the DHS’s role as a primary issuer of critical credentials such as those for cross-border travel, employment eligibility, and citizenship. Jared X. Goodwin, Acting Chief of the Program Management and Data Division at U.S. Citizenship and Immigration Services (USCIS), highlighted that digital credentials and secure digital wallets meet the public’s expectations for convenience and security in a digital age. The standards for these digital solutions, developed by the World Wide Web Consortium (W3C), ensure global interoperability, accessibility, and privacy. The awards stem from the DHS Privacy Preserving Digital Credential Wallets & Verifiers solicitation, reflecting the department's commitment to enhancing service delivery while protecting privacy. This solicitation builds on previous efforts to address the vulnerabilities of paper-based credentials. Each selected company will receive up to $1.7 million across four SVIP phases. The awarded projects and their respective innovations are as follows: - Credence ID (Oakland, CA 🇺🇸 ) received $199,140 to adapt its existing identity verification technology to support W3C standards, allowing for a simple software update to current hardware readers. - Hushmesh Inc. (Falls Church, VA 🇺🇸 ) was awarded $199,430 to incorporate cryptographic security and zero-trust principles into its Mesh technology, enhancing key management for digital wallets. - NETIS Group (Ljubljana, 🇸🇮 ) received $198,849 to enhance its MIDVA platform, supporting organizational onboarding and credential verification through a Fleet Management Platform and Mobile Verifier App. - Procivis AG (Zurich, 🇨🇭) was awarded $187,285 to improve its Procivis One platform, making it more flexible and capable of handling various types of digital credentials. - SpruceID (New York, NY 🇺🇸) received $199,960 to advance its software for creating secure, verifiable digital credentials suitable for multiple sectors. - ubiqu (Rotterdam, 🇳🇱 ) was awarded $197,961 to integrate its Remote Secure Element technology, ensuring user control and secure recovery solutions for digital credential services Link to DHS media release in first comment

46

2 Comments

DeepSeas and Devo are joining forces to transform cybersecurity programs! I’m happy to share that DeepSeas is integrating Devo to be a critical component of its reimagined data lake platform. The integration will bring speed, scale, advanced analytics, and AI capabilities to our midmarket and enterprise clients who choose Devo as their SIEM. Dive Deeper: https://lnkd.in/gMFYXgSV #siem #cybersecurity #logging

1

This is a great step in the Rescale journey - it really reinforces how incredibly important our vision and strategy is in delivery high performance computing and AI driven engineering to both public sector and private organisations.

7

Joseph Goodman, by Steven Palange and Copilot for Microsoft 365, Certainly! Here’s a rewritten “About Me” section and a detailed cybersecurity plan: About Me: With a robust 25-year trajectory in IT, I’ve navigated roles from help desk support to security and compliance leadership at Virginia Tech. My expertise spans across platforms, with a niche in PHP and MySQL for web app development1. Presently, I’m steering IT security and compliance, safeguarding sensitive data across financial, student, and medical domains, and adhering to standards like PCI-DSS and HIPAA2. My tenure in public service as a council member in Pulaski, Virginia, has honed my skills in budgeting, economic development, and fostering collaborative governance. Cybersecurity Plan: Risk Assessment: Conduct a comprehensive risk assessment to identify potential cybersecurity threats. Evaluate the effectiveness of current security measures and identify areas of improvement. Policy Development: Develop clear cybersecurity policies and procedures, including incident response and disaster recovery plans. Ensure policies meet compliance standards like PCI-DSS, FERPA, HIPAA, GDPR, and GLBA2. Employee Training: Implement ongoing cybersecurity awareness training for all employees. Simulate phishing and social engineering attacks to prepare staff for real-world scenarios. Infrastructure Security: Deploy advanced firewalls, intrusion detection systems, and endpoint protection solutions. Regularly update and patch systems to protect against known vulnerabilities. Data Protection: Encrypt sensitive data both in transit and at rest. Establish strict access controls and regularly review permissions. Monitoring and Response: Utilize SIEM tools for real-time monitoring and alerting of potential security incidents. Develop a structured incident response team ready to act on alerts swiftly. Vendor Management: Assess the security posture of all third-party vendors. Ensure vendors adhere to the same ethical and security standards as the company. Continuous Improvement: Regularly review and update the cybersecurity plan to adapt to new threats and technologies. Foster a security culture within the organization, encouraging proactive identification and reporting of security issues. This plan leverages AI capabilities to enhance threat detection, automate security tasks, and provide predictive analytics for proactive defense strategies. It’s designed to be dynamic, adapting to the evolving landscape of cybersecurity threats.

42

Of note - Today, Anduril and Palantir Technologies are announcing a partnership to accelerate the adoption of AI for national security. Together, we’re addressing two core challenges that limit the potential of AI in defense:

7

100%! Enterprise Shared Services are the great equalizer, providing a unified foundation that empowers organizations to build scalable solutions, effectively manage tech debt, and contain costs across the enterprise. A strong shared services model ensures consistency, efficiency, and the ability to adapt to evolving needs while driving long-term value. #enterprisesharedservices #digitaltransformation #modulararchitecture #scalablesolutions #techdebt #ITcostcontainment

11

1 Comment

So this is going to get interesting. The Department of Commerce has essentially stated that any foundational Large Language Model is a dual use defense asset and under federal regulatory control. Key sections out of this are: "To carry out its obligations under section 4.2(a) of E.O. 14110, BIS is exercising its DPA authority, which was delegated to the Department by the President in Executive Order 13603, and subsequently re-delegated within the Department to BIS, to collect information from U.S. companies that are developing, have plans to develop, or have the computing hardware necessary to develop dual-use foundation models. AI models are quickly becoming integral to numerous U.S. industries that are essential to the national defense." "The integration of AI models into the defense industrial base also requires the U.S. Government to take actions as needed to ensure that dual-use foundation models operate in a safe and reliable manner. Products integrating these models may operate in unpredictable or unreliable ways, potentially resulting in dangerous accidents, and a lack of reliability will make it difficult for the U.S. Government to use those products in contexts where the margin for error is small, including defense-related activities where accidents could result in injury or even loss of life. Thus, the U.S. Government needs information about how companies developing dual-use foundation models are training those models to respond to different kinds of inputs and information about how those companies have tested the safety and reliability of their models." The rule goes on to detail quarterly reporting requirements for the model developers. Covered entities are based on size of model and computing capability, not on use or feature. Lets see where this goes, I am sure OpenAI, Google, Microsoft, Tesla, Amazon are reading it carefully.

8

7 Comments

WSJ 4/20 article and today’s War on Rocks article highlight a generational opportunity to attract CompSci grads to cyber force positions We have an oversupply of computer science grads and an under supply of cyber force. Is there an opportunity here to take advantage of under employment of TENS OF THOUSANDS of recruits to a new force structure? The excess pipeline will exist for 4 years max until parents force kids into the “ing” major (engineering, accounting, nursing etc). Let’s not blow this once in a generation opportunity. Is anyone in DoD leadership willing to be Col. John Boyd (OODA, F16 mafia) for a new Cyber Force? Asking for a friend… https://lnkd.in/gKBQW6VP

7

The Pentagon's All-Domain Anomaly Resolution Office is ramping up efforts to address a growing caseload of unidentified anomalous phenomena reports, as new director Jon Kosloski outlines initiatives for enhanced data collection and transparency. For more insights, listen to the latest episode of The Daily Scoop Podcast: https://carah.io/ec576

3

This Army memorandum focuses on enhancing U.S. cybersecurity, especially in federal agencies, through improved software supply chain security practices. The policy mandates that all new contracts involving software acquisition include provisions for Software Bill of Materials (SBOM), which documents the components used in software development. This requirement applies to both government-funded and contractor-developed software. SBOMs help manage vulnerabilities and risks. Overall, this policy seeks to increase transparency and control over software components, reduce supply chain risks, and ensure continuous monitoring and incident response. Is your organization leaning forward on SBOMs? Exiger has the solutions and technology to aid you in on this journey. The risks are not going away. Let us help. #sbom #scrm #cscrm https://lnkd.in/efEi2wdm

15