Article | May 26, 2021
“Belonging to the essential nature of a thing; originating and included wholly within an organ or part.” That is the definition of “Intrinsic.” When we were developing the “IT Manhattan Project” framework, we were doing so in direct response to some of the most significant hacks in U.S. Federal history, which piled on to the already unprecedented push to expedite the modernizing of federal IT because of the COVID-19 response. The COVID-19 response shifted the way that the U.S. federal government operated, where our workforce worked from, the immediate need for mobile ‘available from anywhere’ workloads, and how to both secure and support that new way of doing federal business. A new, vigorous push towards rapidly modernizing federal IT environments was underway. Ultimately, it laid the groundwork for producing transformational federal memos and oversight by way of some of the following:
Executive Order 14028: “Improving The Nation’s Cybersecurity”
M-22-09: OMB’s Zero Trust Strategy M-22-09
NIST 800-53rev5: Fulfilling an expedited realization of the overall intent of NIST 800-53r5 through the emphasis on things like conditional access, TIC 3.0 frameworks, Secure Orchestration/Automation/Remediation, and modernized, agile approaches to secure micro-segmentation from Hybrid Environments up to Federal Cloud instances
Overall mandates like these carry with them a consistent anthem driving at rapid IT modernization with rigorous proof of performance schedules attached. Piling on top of those Herculean efforts, the urgency was drastically increased by several of the highest profile cyber compromises in U.S. federal history. Rapid modernization had to happen right away. The time for IT transformation was here, backed by promises of significant funding and a high level of political visibility.
The Shift to Zero Trust
At their core intent, Zero Trust architectures are expected to provide a centralized policy structure that dictates how every individual flow in our IT environments are permitted to talk. No user, host, or flow is permitted without being subjected to rigorous authentication and authorization policy. This shifts our previous understanding of North-South, East-West traffic and how we police it. The foundational intent of Zero Trust architectures centers around applying unified policy to every transaction that occurs between enterprise resources, and doing so in ways that are agnostic to the IT Silo that they reside in.
Zero Trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location.”
NIST 800-207 aptly
They go on to explain that the scope of this posture includes all assets, workflows, network accounts, and the like. In summary, police everything, abstract production traffic intent from the underlying infrastructure that supports it, and institute a unified security posture to execute the policing at every network entry point. Regardless of the domain. We all know that this is a tectonic but much-needed shift in our industry. I’d go so far as to say that the successful instantiation of this approach across Federal IT environments is critical to our national security going forward.
Management Complexities
Enterprise IT domains contain varied mixtures of OEM solutions, home-grown tools, and utilize a wide variety of protocols to intercommunicate that aren’t necessarily standardize. Each of these domains is normally managed by separate IT teams who specialize in maintaining those environments. In the federal landscape, each of these domains aren’t just managed by separate enterprise IT teams, but are commonly managed by different contractors. Therefore, IT security organizations have a difficult time achieving and maintaining the necessary operational awareness required to enforce centralized policy. These cultural complexities exacerbated by budgeting concerns have created a fatalistic mentality when it comes to far-reaching mandates. This is where the tectonic shift in architectural and administrative approach is so necessary. This is where multidomain architectures shine.
Let’s define a common baseline of enterprise domains seen across traditional IT environments:
Cloud
Data Center
Enterprise Networking
Extended Enterprise (IoT, OT/ICS)
Remote Access
But to deliver a successful Zero Trust across the enterprise, it is first necessary to understand some foundational building blocks on which to construct our architectural approach:
We can’t have MULTIDOMAIN POLICY without first achieving fuller
We can’t deliver macro and micro-segmentation without first having robust MULTIDOMAIN
We can’t have multi-vendor MULTIDOMAIN Zero Trust POLICY without sensical INTEGRATIONS to stitch each enterprise domain together.
Let’s face it, enterprise IT environments don’t simply include infrastructure from a single manufacturer, or even a few key manufacturers. Rather, our Enterprise IT environments are represented by a plethora of IT manufacturers specializing in different niches of IT and the domains they are commonly found in. These environments are managed by different Federal IT organizations, different contractors who support these Federal IT organizations, and many different teams that support each common IT silo. Different teams that support oft-compartmentalized areas like Network Security Operations, Network Operations, Data Center Operations, Institutional Services, Wide Area Networking contracts, Operational Technologies, and dotted lines to different leadership oversight like CIO Programs, CTO Architecture, the Cyber Security Office, and the audit oversight bodies that they are subjected to. Each of these make up a complex support structure that isn’t necessarily streamlined for efficiency.
Summary and Overarching Goals
In articles to follow, you’ll see us referencing the IT Manhattan Project framework several times. Though many details of the framework can’t be discussed due to their sensitivity, the foundational principles are relevant across the board when pursuing intrinsic multidomain Zero Trust.
Establish Visibility (Administration, Telemetry, Assurance)
Define Straightforward Policy Structure and Hierarchy (Auth Chains)
Perform Multidomain Integrations (API Integrations)
Deploy Software-Defined Framework (Day-0, Programmable Fabrics, Multi-OEM Fabric Integrations)
Establish Sensical Automation Runbooks (Day-2 Operations)
We will also explore some areas that deliver unexpected value to the agency business in immediate ways. All of this will help create a cohesive story that helps CIOs, CISOs, and enterprise architects alike communicate the criticality of this multidomain Zero Trust approach to agency leaders across the federal spectrum.
Read More
Government Business
Article | July 11, 2022
The biggest IT challenge local governments faced during the COVID-19 pandemic has been scaling existing infrastructure to accommodate many more workers than they had planned for, IT leaders said during a June 17 panel discussion. “Our remote access solution was originally scaled for a major snow day, not for 3,000 to 4,000 remote users,” Charles Gore, IT security manager for Loudoun County, Va., said during a webinar presented by CompTIA’s Public Technology Institute. “We were looking at 500 users remote. We had to spread the scoping across multiple technologies, which we had, but we needed to very quickly adjust to accommodate the new users.”
Read More
Government Business, Government Finance
Article | July 12, 2022
While Americans wait to see if Congress will pass an infrastructure bill, alternative funding and collaborative initiatives are becoming the norm. Even the recent announcement that the U.S. is now in a designated recession has not caused Congress to focus specifically on economic recovery. Economists, financial experts, industry leaders, and elected officials all know that funding large public projects stimulates the economy and creates jobs. They also know that throughout history, infrastructure reform has been a proven path to economic recovery.
Currently, private sector investors stand ready to fund infrastructure projects in America and local government leaders are moving forward to launch projects of all types. Soon, there may be little need for Congress to do anything. The opportunity to lead in this area may soon be usurped by visionary regional leaders and private sector partners.
Destruction brought on by climate change, the devastation resulting from COVID-19, cyber threats on public networks, lack of adequate broadband, and a desperate need for new sources of revenue – these are the problems that have forced visionary leaders to take action and not wait for Congress. Now, change is coming on strong, and that’s a very good thing!
Airports are not waiting to launch critical and long-overdue expansions. State leaders already are combating rising seas and finding ways to install broadband. Wastewater plants are being constructed or upgraded, and various transportation projects are being launched. Because local leaders lacked the luxury of waiting to see if Congress would endorse or partly fund infrastructure projects, they found alternative funding sources.
Congress could have, and should have, already passed an infrastructure bill, even if it only established guidelines or outlined best practices. The Canadian Council for Public Private Partnerships would have been a good model to follow. An endorsement or a statement of support from Congress related to public-private partnerships (P3s) would still be encouraging.
But, with or without encouragement, regional leaders throughout the country are working with industry, nonprofit organizations, academia, and investors to launch large infrastructure projects. And, as that happens, local economies benefit and jobs are created. Entire communities and numbers of citizens benefit from the good that emanates from public safety, quality of life, asset preservation, sustainability, and taxpayer relief.
But, to the surprise of no one, infrastructure projects are costly and many of them require a number of consolidated funding sources. Infrastructure projects also may be funded through a revenue repayment model that compensates private sector investors over a decade or two. Other projects are funded by bonds, grants, and federal programs such as the Tax Cuts and Jobs Act which incentivizes investment into designated Opportunity Zone regions of the country.
Additionally, funding is still available from federal programs that have been in existence for decades. The Federal Emergency Management Agency (FEMA), Army Corps of Engineers, Department of Housing and Urban Development (HUD), and Community Development Block Grant programs all have funding that may be merged with other alternative funding sources.
Many state legislatures have allocated funding for ‘rainy days’, emergencies and/or ‘resiliency’ efforts. Special Districts also may be created by cities, a process that authorizes citizens to tax themselves for critical infrastructure projects. Finding numerous funding sources is not difficult and not a hurdle that stops infrastructure reform.
Two rather important issues, however, have slowed public acceptance of alternative funding and public-private partnerships – a lack of understanding by citizens about the cost and danger of not doing anything and the fact that the public at large does not completely understand the history or the success of P3s. Too many citizens view private sector investment into public projects as a new or risky concept, which is not the case. Collaborative initiatives have been responsible for the building of America’s infrastructure for more than 100 years. And, the public-private partnership model is common throughout the world and has been tested over many decades.
Here are but a few examples of visionary infrastructure initiatives happening now in America.
In Virginia, the Greene County Board of Supervisors has approved guidelines for establishing strategic public-private partnerships to develop numerous types of P3 projects in the county. This action will enable the Greene County School Board to enter P3s for the purpose of building educational facilities. Other possible projects likely will include landfills, drinking water production, and distribution systems. Projects also may include fire department facilities, education construction including stadiums, public safety buildings, utility and telecommunications initiatives, and broadband infrastructure.
The University of California (UC) has provided a 2019-2025 Capital Finance Plan (CFP) that represents $52 billion of capital that will be required by the campuses and its medical centers. The CFP outlines plans for proposed capital projects, P3s and the acquisition of real property. UC has found the P3 model to be efficient, especially for campus housing. The Irvine campus has a long history of partnering with third-party entities to advance its strategic goals.
The Yuma, Arizona City Council has approved a $51.4 million increase from last year for a Capital Improvement Program (CIP) budget. The city expects 45 percent of the costs to be obtained through grants, reimbursements, and P3s. The plan outlines 54 projects and funding plans of $20.3 million for projects in the Yuma Crossing National Heritage Area. The city also plans to augment funding with a federal grant and possibly private sector investment. It has scheduled a regional fiber optic infrastructure project for 2021 and has announced interest in a P3 engagement as the delivery model.
Florida’s Palm Beach Town Council recently approved $316,380 for a water supply feasibility study. An engineering firm will address the town’s need to explore different ways to provide residents potable water. A plan to determine how to meet future water demand is the objective. One option under consideration is to enter into a public-private-partnership to accomplish this objective.
Iowa State University is taking steps to become coal-free and reduce greenhouse gas emissions by 35 percent over the next three years. A P3 is being considered for the operation of its utility system. The university’s Board of Regents this month gave approval for a planning process to begin.
The state of Nebraska is considering a public-private partnership to build a new 1,600-bed prison to deal with overcrowding and staffing issues. Cost of the new prison has been projected to be in the $200 million range or higher, and the state anticipates that a P3 will be the delivery method. The department announced that the project would potentially meet space needs for the next 100 years.
These projects offer just a sampling of what is happening throughout America. State and local leaders are moving forward and not waiting for guidance or encouragement. Instead, most have grabbed the reins of America’s race to the future, and started to address the country’s infrastructure needs. That’s comforting, because there is much to be done.
America’s global competitiveness truly hangs in the balance along with the well-being of millions of families impacted by unemployment. A recession is never good, but this one could be short. Here’s hoping the media, citizens at large, and others who understand the country’s critical infrastructure problems will find ways locally to step up and encourage other elected leaders to support this clear path out of the current recession.
Mary Scott Nabers is president and CEO of Strategic Partnerships Inc., a business development company specializing in government contracting and procurement consulting throughout the U.S. Her recently released book, Inside the Infrastructure Revolution: A Roadmap for Building America, is a handbook for contractors, investors and the public at large seeking to explore how public-private partnerships or joint ventures can help finance their infrastructure projects.
Read More
Article | September 4, 2020
Motorists and automobile lovers are already noticing rather rapid change. Sustainability goals adopted by elected officials at cities and counties are continuing to promote projects that support walking, biking, and using public transportation. Housing density, walkable communities, technology enhancement and convenient public transportation are the goals.
Parking options are being reduced. Automobiles are being banned on many community streets, and cities are adding parks, entertainment venues, affordable housing, and more retail. Mixed use development, biking lanes, and convenient transportation options for non-motorized travel are the goal. The arguments for such changes are that people will be healthier and safer, the air will be cleaner, and there will be more options for people with disabilities. The trend is called ‘livable and walkable communities,’ and as it sweeps through the country, it opens up thousands of partnering opportunities between public entities and private sector contractors.
Indiana
The city of Indianapolis plans to add more sidewalks throughout the city and has commissioned an inventory to determine how many and which streets don’t have a sidewalk. The results of that study will be published by the end of 2020. The city, which covers 360 square miles, has approximately 8,400 lane miles of streets. Indiana’s Department of Transportation maintains about one-third of the state’s sidewalks, and the cities are responsible for the rest. The study is part of the Indy Moves plan, a long-range planning document that combines walking, biking, and public transportation goals. More than 400 projects are outlined that include building new roads, developing greenways, upgrading existing roads with sidewalks, and constructing more bike lanes. Adding sidewalks to every street without them could cost more than $1 billion. The sidewalks, however, appear to be a high priority because city officials have pledged net zero carbon emissions by 2050 and that requires fewer automobiles in the city.
Texas
In August, the city of Houston approved a plan that is built around walkable places and transit-oriented programs that encourage pedestrian-friendly spaces. The city, like many others throughout the country, will work to promote mixed-use development designed for walkability. For three years, the city has studied ways to make neighborhoods more walkable. Its new plan lists Midtown, Emancipation Avenue, and the Northside as the first places of high focus. Ordinances will be effective beginning October 1. Some of the first initiatives include the construction of facades closer to the road, expansion of sidewalks and relocation of parking lots to the side or rear of buildings. Additionally, the ordinances call for additional bike parking standards in areas that are within a half-mile walking distance from Metro transit station platforms.
New Hampshire
The Southern New Hampshire Planning Commission recently unveiled its Transit-Oriented Development (TOD) Plan. The document outlines projects that include constructing streets and paths that encourage walking and biking. It calls for developing safer intersections and compact and well-signed city blocks. The city of Manchester has applied for a $25 million federal grant to will help fund a pedestrian bridge and the addition of a new street to help alleviate traffic congestion around the Southern New Hampshire University parking garage. City leaders hope to know by November if their grant request has been approved. If so, projects related to improving connectivity and walkability will be launched. The plan calls for an approximate $125 million investment, but the projects could unlock $600 million more in anticipated development. The new developments are expected to include a facility for 1,802 residential units, a hotel with 154 rooms, 785,000 square feet of office space, and 198,000 square feet of retail space.
Illinois
The city of Chicago has announced an initiative called INVEST South/West. This plan commits $750 million of public funds for projects in 12 commercial corridors in 10 neighborhoods. The objective of this plan is to improve streetscapes and public and also strengthening transportation networks and repurposing vacant lots for public amenities and affordable housing. Currently, three solicitation documents have been released for one neighborhood but numerous others will be released in coming months for projects in other neighborhoods. The initial solicitation documents call for proposals by November 24 with construction to begin by the end of 2020. Projects outlined for the various neighborhoods were developed through a months-long community-engagement process, and the developers and contractors will be expected to begin work quickly.
California
The city of Modesto has approved a 20-year plan that calls for bicycle lanes as well as widening and enhancing of sidewalks. Other projects are also planned with the overall objective of making neighborhoods more convenient for non-drivers and encouraging foot traffic and bicycles. City leaders point out that the downtown area has strong office, restaurant, and entertainment sectors, but there is a desire to reduce automobile traffic. Denser housing options and the encouragement of transportation options that include walking and biking are the goal. Construction of new home sites, retail, and other uses will be left to developers. City leaders plan to replace the Stanislaus County Courthouse and adjacent jail to make that property available for new, denser home sites. A pedestrian-friendly route would lead to the Tuolumne River.
Georgia
Clayton County and the cities of Sandy Springs, Savannah, and Valdosta were selected for funding in Georgia Tech's 2020 Georgia Smart Communities Challenge. Each region will receive $100,000 in grant funding to be used for planning purposes. The Clayton County Smart Pedestrian Planning project outlines plans to promote mobility, equity, and the identification of smart technologies to support walkability in communities. Sidewalk data will be collected, and the county will oversee the selection of pilot projects in locations that represent different neighborhood typologies. The first projects will be studied for future development of additional regions.
Cities and counties throughout the country are rushing to meet sustainability goals and these efforts are resulting in an abundance of contracting opportunities for developers, engineering firms, construction companies, landscape firms, and technology providers.
Mary Scott Nabers is president and CEO of Strategic Partnerships Inc., a business development company specializing in government contracting and procurement consulting throughout the U.S. Her recently released book, Inside the Infrastructure Revolution: A Roadmap for Building America, is a handbook for contractors, investors and the public at large seeking to explore how public-private partnerships or joint ventures can help finance their infrastructure projects.
Read More