Reducing Cybersecurity Risks in Supply Chain Risk Management

Shon Lyublanovits, IT Security Subcategory Manager and Director of the Security Services Division

[Editorial note: This blog is the last of a three part series by Shon Lyublanovits, GSA’s IT Security Subcategory Manager and Director of the Office of IT Security Services for Office of Information Technology Category (ITC). Designed to help build awareness of the Department of Homeland Security’s (DHS) annual October National Cyber Security Awareness Month, this blog series describes a suite of cybersecurity products, services and solutions provided by GSA, outlining the unique benefits each provides to government].

Federal Information and Communications Technology (ICT) systems rely on a complex, globally distributed, and interconnected supply chain ecosystem encompassing geographically diverse routes and multiple tiers of outsourcing. Managing ICT systems is a difficult and complex task for government agencies — especially when these system are affected by various laws, trust models, interests, and national/international supply chains. It becomes even more difficult when criminals constantly introduce proprietary counterfeits and malware, conduct data tampering, and access sensitive information.

To protect ICT systems from criminals, we are working with government agencies to reduce cybersecurity risks through the acquisition of IT hardware and software. We’re also helping government leaders, chief information officers, and IT experts develop and implement sound policy guidance to deploy Supply Chain Risk Management (SCRM) activities throughout the entire acquisition lifecycle.

Challenges for government and industry

The federal government is facing significant cybersecurity challenges when procuring IT products or services resulting from inadequate in-built cybersecurity controls in the supply chain. An increase in the use of ready made, off-the shelf products, plus a rise in outsourced computer and communications operations make it more difficult to manage the supply chain.

Our industry partners are facing challenges as well. Companies require agile, elastic business models to remain competitive and keep pace with emerging technologies, but they also need to protect themselves against volatile cybersecurity threats, especially in the supply chain. From a national security perspective, when large components of these business models become vulnerable to cyber threats, the private sector becomes a target of nation states.

Enhancement of IT procurement through sound policy drives

Within the global marketplace, particularly the supply networks, criminals have more opportunities to penetrate and potentially manipulate information and technology. In order to mitigate these threats, GSA supports various statutory, regulatory, and policy requirements that address the current challenges of the global marketplace.

We are currently developing a Business Due Diligence Information Service that will give agencies a common government-wide capability for identifying, assessing, and managing cyber and supply chain risk throughout the acquisition process.

GSA is also leading the implementation of an IT policy that enhances IT acquisition vehicles, resulting in increased security of customers systems and networks. We are working with federal agencies to address supply chain risks by:

  • Reviewing base ITC acquisition vehicle contract language
  • Developing an acquisition assurance baseline by identifying provisions and clauses that are related to IT security and SCRM to use in IT product and service solicitations
  • Creating a repeatable, scalable SCRM response process for ICT to effectively respond to SCRM incidents and issues of public interest. This includes a description of various roles, responsibilities, and definitions for six phases of the ICT Supply Chain Threat Event (SCTE) Incident
  • Using Response Life Cycle — i.e., notification, escalation, evaluation and validation, reporting, response, and closure activities
  • Establishing a Vendor Risk Assessment Program to provide a well-defined process and robust capability to evaluate known or potential risks related to suppliers of products and services using open source information

Comprehensive SCRM cybersecurity regulations and requirements

ICT systems need the best IT solutions to protect against proprietary counterfeits and malware, data tampering, and unauthorized access to sensitive information. We ensure that our IT products and services in the supply chain are deemed cyber low-risk by complying with cybersecurity regulations and requirements specific to SCRM. This will establish sound policy safeguards, so that when government agencies purchase IT products and develop systems, they do so knowing that we worked with suppliers to determine if SCRM capabilities have been applied to acquired products and services.

We’re also establishing a comprehensive SCRM capability that will ensure government agencies procure IT hardware and software from original equipment manufacturers, including authorized resellers or other trusted sources. Furthermore, GSA is:

  • Managing incidents within IT contracts
  • Establishing and maintaining contact with both internal GSA stakeholders and external agencies on cyber incidents
  • Maintaining awareness of government-wide supply chain policy/trends

GSA remains committed to helping government leaders, chief information officers, and IT experts improve cybersecurity through SCRM. Read the first and second blogs in this series to learn more about our cybersecurity products, services and solutions and how they can help you focus on your mission, while maintaining quality, reducing costs, and minimizing duplications and redundancies.

Follow us on Twitter @GSA_ITC to join the conversation.

Helping Agencies Strengthen Cyber Networks through Strategically Sourced Tools and Services

Shon Lyublanovits, IT Security Subcategory Manager and Director of the Security Services Division

[Editorial note: This blog is the second of a three part series by Shon Lyublanovits, GSA’s IT Security Subcategory Manager and Director of the Office of IT Security Services for Office of Information Technology Category (ITC). Designed to raise awareness of the Department of Homeland Security’s annual October National Cyber Security Awareness Month campaign, this blog series highlights a suite of cybersecurity enhancing products, services and solutions provided by GSA, outlining the unique benefits each provides to government].

In today’s cyber ecosystem many, if not all, government mission requirements depend upon IT systems. Government agencies need to go beyond simply knowing who and what is on their networks. Senior leaders, chief information officers, and IT experts across government must be ready to face all potential cyber threats and it is critical that all information be secure. The latest IT tools and associated services are essential if agencies are to effectively and proactively identify, manage, and respond to new vulnerabilities and evolving threats. Agencies must also be able to keep up with and anticipate constant change in the enterprise architecture and operational environment.

GSA remains committed to helping agencies meet these ever-evolving challenges by offering a suite of pre-vetted cybersecurity products, services, and solutions that help agencies comply with mandates and IT requirements, while also addressing cyberattacks. This includes working with the Department of Homeland Security (DHS) to establish a new Special Item Number (SIN) for IT Schedule 70: Continuous Diagnostics and Mitigation (CDM) Tools. With CDM tools, we’re able to meet the government’s need for stronger cyber networks with strategically sourced tools and associated services.

New SIN offers agencies improved flexibility in IT procurement and cybersecurity

Our IT products on the CDM Tools SIN are prequalified and approved by DHS. And by leveraging the buying power of the government and streamlining the procurement process, we’ve made it easier and less expensive for our government partners to get the flexible solutions they need to effectively mitigate ever-changing cybersecurity threats.

Furthermore, these flexibilities on the CDM Tools SIN give government customers — federal, state, local, regional, tribal and territorial government entities — even easier access to a governmentwide set of information security continuous monitoring (ISCM) tools. The new CDM SIN also:

  • Enhances and automates existing continuous network monitoring capabilities
  • Strengthens the security posture of government networks
  • Improves risk-based decision making at the agency and federal enterprise level

CDM Tools SIN enhances existing continuous network monitoring capabilities

The CDM Tools SIN gives government agencies the ability to identify cybersecurity risks, prioritize them based upon potential impacts, and enable cybersecurity personnel to mitigate the most significant problems first.

We’ve organized the capabilities and tools into five subcategories:

  1. Manage “What is on the network?” — Identifies the existence of hardware, software, configuration characteristics, and known security vulnerabilities.
  2. Manage “Who is on the network?” — Identifies and determines the users or systems with access authorization, authenticated permissions, and granted resource rights.
  3. Manage “How is the network protected?” — Determines the user/system actions and behavior at the network boundaries and within the computing infrastructure.
  4. Manage “What is happening on the network?” — Prepares for events/incidents, gathers data from appropriate sources, and identifies incidents through analysis of data.
  5. Emerging tools and technology — Includes CDM cybersecurity tools and technology not in any other subcategory.

CDM strengthens government networks

We want to help government fight cyberattacks by providing tools to help detect vulnerabilities and protect agencies from threats. These tools enhance government network security through automated control testing and progress tracking. This approach:

  • Provides services to implement sensors and dashboards
  • Delivers near-real time results
  • Prioritizes the worst problems within minutes (not quarterly or annually)
  • Enables defenders to identify and mitigate flaws at network speed
  • Lowers operational risk and exploitation of government IT systems and networks

Easy Ordering

Purchasing officers can buy from the CDM Tools SIN through eBuy and GSA Advantage!®. Issue a request for information (RFI) or request for quotation (RFQ), and let vendors respond to your requirements. Likewise, government agencies can purchase products, services, and solutions through IT Schedule 70’s Cooperative Purchasing Program.

For more information

If you have questions about the CDM Tools SIN, contact the IT Customer Service Center at (855) ITaid4U/(855) 482-4348 or schedule70cdmsin@gsa.gov. Representatives are available Sunday at 8:00 p.m. through Friday at 8:30 p.m.

Learn more about GSA’s CDM Program.

Please follow us on Twitter @GSA_ITC and LinkedIn to join our ongoing conversations about government IT.

HACS SIN Helps Agencies Protect High-Value Assets (HVAs)

Shon Lyublanovits, IT Security Subcategory Manager and Director of the Security Services Division

[Editorial note: This blog is the first of a three-part series by Shon Lyublanovits, GSA’s IT Security Subcategory Manager and Director of the Office of IT Security Services for Office of Information Technology Category (ITC). Designed to help build awareness of the Department of Homeland Security’s (DHS) annual October National Cyber Security Awareness Month, this blog series describes a suite of cybersecurity products, services and solutions provided by GSA, outlining the unique benefits each provides to government].

It’s no secret that risk management is critical to the way government protects its information, assets and systems.

Federal agencies use large complex network and data systems to maintain and manage varying types of data and information, including High Value Assets (HVAs) that hold sensitive information critical to national and economic security. Some of this information is so critical that disclosing it could cause significant harm to government operations, law enforcement agents, men and women in uniform, and even private citizens. Knowing that, you may wonder if it’s still possible to provide easily accessible information and data sharing as well as other programs that increase citizen and organizational participation in government.

The answer is yes.

GSA stands ready to support government leaders, chief information officers, and IT experts by providing Highly Adaptive Cybersecurity Services (HACS) SINs to identify, prioritize, and protect HVAs from criminal hackers. GSA’s HACS SINs provide government agencies with comprehensive protection against the ever-increasing threat of cyberattacks by offering access not just more, but better IT cyber services and expertise.

Government agencies have more access to HACS SIN services and expertise

GSA has awarded more than 70 suppliers with HACS SINs to date. These industry partners give government agencies more access to services so they can test high-priority IT systems, rapidly address potential vulnerabilities, and stop adversaries before they impact HVAs. And to ensure that we have top notch expertise in cybersecurity, we’re always looking for more partners and more options to expand, enhance, and integrate these services with the national security community.

In addition, by using our HACS SINs on IT Schedule 70, government agencies can access the expertise needed to shorten procurement cycles, ensure compliance with mandates and IT requirements, and obtain the best value for innovative technology products, services, and solutions.

Improved protection to deter the ever-increasing threat of cyberattacks

Our IT Schedule 70 HACS SINs offer a suite of cybersecurity services that help government agencies face and deter the ever-increasing threat of cyberattacks. Agencies can deter these threats by protecting HVAs and critical enterprise-wide network infrastructures from our adversaries, enhancing data security on smart devices, and fortifying legacy systems by reducing their accessibility risks.

Improved protection of HVAs and critical enterprise-wide network infrastructures from our adversaries

  • Our 132-45D Risk and Vulnerability Assessment (RVA) SIN was developed with the methodology DHS uses to conduct assessments of agency HVAs. All vendors awarded this SIN have been screened through an oral technical evaluation process that follows the DHS methodology.

Enhancement of data security on smart devices

  • Our HACS Penetration Testing, Incident Response, Cyber Hunt and RVA SINs provide customers with access to vendors that are capable of providing these services across the network. Services include, but are not limited to, network mapping, vulnerability scanning, and wireless assessments. Employing the full HACS suite of services will address many of the threats to agencies’ data and improve the security of all devices connected to their networks.

Fortification of legacy systems

  • Our IT procurement specialists are committed to helping federal, state, local, and tribal governments protect their HVAs by enhancing or replacing their legacy systems with advanced emerging technologies.

HACS SINs Information Session for State and Local Government

Cybersecurity implementation can be challenging our customers, especially those unfamiliar with our IT Schedule program. We’re hosting an information session this month for state and local government so that all eligible entities, including tribal governments, can take advantage of the HAC SINs’ benefits.

  • When: Monday, Sept. 18, 2017, 10:00 a.m. to 12:00 p.m. EDT.
  • Where: Join us virtually, in Adobe Meeting Space!

We hope to see you there – register today!

For more information, please contact the following:

Please follow us on Twitter @GSA_ITC and LinkedIn to join our ongoing conversations about government IT.