Six directors were elected to serve three-year terms and one was appointed to fill a vacancy for a two-year term.

The new board members are:

• Linda Bixby, Executive Vice President, Academic Partnerships, NobleReach Foundation
• John DeSimone, President, Cyber Security, Intelligence and Services, RTX
• Barbara Haines-Parmele, Vice President and Division Manager, National Intelligence Solutions, ManTech
• Gordon Hannah, Principal, Deloitte
• Michael LaRouche, Business President and Board member (*appointed to a two-year term)
• Al Perez, President, Ariel Secure Technologies
• Roy Stevens, President, National Security Sector, Leidos

“We are honored to welcome such a dedicated and skilled group of leaders to our board,” said Long. “With an existing wealth of experience and expertise among our directors, the addition of our new colleagues promises to infuse fresh perspectives, ignite new ideas, and deliver even greater outcomes.”

Source: INSA

Your competitors read IC News each day. Shouldn’t you? Learn more about our subscription options, and keep up with every move in the IC contracting space.

The post INSA adds seven board members appeared first on Intelligence Community News.

“Congratulations to Lieutenant General Jeffrey Kruse, United States Air Force, on his confirmation as the 23rd Director of the Defense Intelligence Agency (DIA)! Backed by extensive experience and an extraordinary commitment to ethics in defense of country, the Intelligence Community is very fortunate to have him lead our Defense Intelligence enterprise amidst the increasingly complex threat environment we face today. Though I will sorely miss Jeff’s sage advice as my Advisor for Military Affairs, it will be wonderful to work with him in his new role, as he leads the truly exceptional DIA workforce.

I would also like to thank Lieutenant General Scott Berrier, United States Army, on his remarkable leadership of DIA over the past few years during an exceptionally defining and dynamic period for the security of both our nation and world. Scotty is as amazing of a leader as he is a human being, and I wish him nothing but the best in his hard-earned and well-deserved retirement.”

Source: ODNI

If you enjoyed this article, please consider becoming a paid subscriber. Your support helps keep our site ad-free.

The post Jeffrey Kruse confirmed to lead DIA appeared first on Intelligence Community News.

From IC Insider HashiCorp

By: Joshua Tracey, Resident Engineer, HashiCorp Federal, & Greg Thomas, Sr Solutions Engineer, HashiCorp Federal

YouTube: @The Sudo

Medium: @cobra16

Modern information technology (IT) abstracts infrastructure from physical hardware using logical constructs programmed in software. The challenge is having a unified way to provision infrastructure and take advantage of multi-cloud despite the skills gap, cost, compliance security, and operational overhead.

Most major Cloud Service Providers (CSPs) have integrated IaC tools within their vertical platform, such as Amazon Web Services Cloud Formation or Microsoft Azure Resource Manager; however, these tools do not scale horizontally across multiple CSPs, support traditional data centers or bare metal. Terraform provides IT administrators with the horizontal, multi-cloud workflow they need.

In our last article, infrastructure as code in government and regulated industries, we learned how to use a platform approach versus DIY scaffolding to obtain value from IaC in regulated industries and government. Recently, an interesting post by Defense Scoop announced that “Intelligence agencies (are) confronting challenges with multi-cloud environments.”  To effectively take advantage of multi-cloud in regulated industries and government, a platform approach is needed to close the skills gap and tighten security. This white paper reveals solutions that did not exist until recently. We aim to explain the often-overlooked benefits of Terraform Agents and HashiCorp integration with ServiceNow, taking a platform approach to IaC for multi-cloud environments.

Challenge: Behind the “push button automation,” there is always code. Even though we can abstract it away, it has to be codified. Terraform Cloud or Terraform Enterprise TFC/TFE are not designed to supplement CI/CD platforms. In most cases, work must be done before and after a Terraform plan and apply, or sometimes between a plan and apply. This leads to creating complex pipelines that, at some point, kick off a plan and apply against a TFC/TFE workspace and then have a mechanism to report back to the pipeline when the plan or apply is finished.

Solution: The hooks for agents help alleviate this by allowing actions pre-plan, post-plan, pre-apply, and post-apply. Imagine you wanted to run a pre-plan action on your Terraform code, then a post-plan action to validate the plan will apply, rather than waiting for a Terraform apply to fail 15 minutes in. Imagine you wanted to send an API call somewhere to notify someone that an apply has finished. You can take advantage of countless options and use cases like this with Terraform agents. You can also increase security by having a clear delineation point between agent pools assigned to respective workspaces.

Examples: Imagine an agency has a custom API to determine if resources can be provisioned. When everything is ok, the API returns “200”, meaning everything is ok, and resources are permitted to be deployed. In an emergency, audit, or security issue, the agency can push a button and force this API to return a 403 not-permitted. This gives complete control over all the infrastructure resources or assets deployed at a very granular level.

Below is an example of a custom Terraform Cloud Agent configured with a pre-plan hook that checks the API. If the API returns status 200, the pre-plan hook exits with a 0 exit code, allowing the plan to continue.

Next, a post-plan hook runs. In this particular deployment, an Azure Storage Account is being created. The name is always dynamically generated, so the team wants to ensure the generated name is globally unique before moving to the apply phase, waiting a few minutes, and then finding out the name is already taken. In this case, it saves time by allowing us to fail fast, iterate on the code and deliver the mission faster. Over the hundreds of thousands of resources deployed, this can save upwards of 10K hours a year.

Because all workspace variables are passed to the Terraform Cloud Agent as environment variables, we can securely interpolate variables into the script that checks the Azure API for the storage account name. The $AZURE_ACCESS_TOKEN variable in the script is taken from the Terraform Cloud Workspace variable below. The same applies to the $ARM_SUBSCRIPTION_ID and $STORAGE_ACCOUNT_NAME variables.

Finally, a post-apply hook is run. In this example, an internal system needs to be updated for audit purposes, a notification is sent via webhook to the workspace owner, and the Ansible automation platform API is called to trigger additional configurations.

Challenge: Resources often must be deployed into multiple secure and isolated environments. These environments usually cannot allow inbound connections from Terraform Cloud or Terraform Enterprise. Some of these environments only allow communication to cloud services via private endpoints. Other environments, such as air-gapped, only allow communication to internal applications such as vSphere from within the network.

Solution: Terraform Cloud Agents can be deployed into any isolated network to help solve this problem. Agents only require outbound connectivity to Terraform Cloud or Terraform Enterprise. The agent architecture is pull-based, so no inbound connectivity is required. Any agent you provision will poll Terraform Cloud or Terraform Enterprise for work and carry out the execution of that work locally. You can leverage ServiceNow and Terraform Enterprise for “push button automation” to get the most value out of multi-cloud environments. This approach allows you to follow the best practices for enterprise use of infrastructure as code for compliance and security, cost savings, and isolation for billing and programmatic purposes. By connecting ServiceNow to Terraform Cloud or Terraform Enterprise, the Terraform Service Catalog integration enables platform teams to provision self-serve infrastructure by creating workspaces and performing Terraform runs from the ServiceNow interface.

Thank you for reading and learning more about HashiCorp’s infrastructure automation solutions.

About HashiCorp

HashiCorp is the leader in multi-cloud infrastructure automation software. The HashiCorp software suite enables organizations to adopt consistent workflows to provision, secure, connect, and run any infrastructure for any application. HashiCorp open source tools Vagrant, Packer, Terraform, Vault, Consul, and Nomad are downloaded tens of millions of times each year and are broadly adopted by the Global 2000. Enterprise versions of these products enhance the open source tools with features that promote collaboration, operations, governance, and multi-data center functionality. The company is headquartered in San Francisco and backed by Mayfield, GGV Capital, Redpoint Ventures, True Ventures, IVP, and Bessemer Venture Partners. For more information, visit www.hashicorp.com or follow HashiCorp on Twitter @HashiCorp.

About IC Insiders

IC Insiders is a special sponsored feature that provides deep-dive analysis, interviews with IC leaders, perspective from industry experts, and more. Learn how your company can become an IC Insider.

The post Industrialize Infrastructure as Code in Government and Industry appeared first on Intelligence Community News.

SoundWay was one of the first to be named a C3PAO candidate and is now among the first 25 authorized by The Cyber AB to conduct CMMC assessments. This authorization demonstrates SoundWay’s subject matter expertise and ability to deliver CMMC assessments at Level 2. SoundWay has been helping government contractors prepare for CMMC assessments as a Registered Provider Organization (RPO) for over 1.5 years.

In addition to becoming an authorized C3PAO, SoundWay also announces a portfolio of training capabilities for both government and industry to dramatically reduce exposure to harm stemming from cyber liability associated with government contracts and other legal obligations.

SoundWay partnered with the Advanced Assessment Academy (AAA) to produce courseware now available for the Government’s Acquisition Workforce, Attorneys specializing in Government Contracts, Prime Contractors that need to validate their subcontractors, and companies that plan to self-attest. These courses will dramatically reduce both the government’s and industry’s exposure to financial harm stemming from CMMC requirements.

“Obtaining our C3PAO designation is an integral part of SoundWay’s growth strategy. We continue to see an exclusive focus on Government Contractors being able to demonstrate conformance with DFARs and CMMC obligations, yet little momentum exists on improving contract language, teaming agreements, and fully understanding that cyber liability does not stop with CMMC obligations. SoundWay is very excited at the prospect of delivering with AAA, high value, scalable, and cost-effective training content to significantly reduce the risks to cost, schedule and performance issues we have identified over the past two years,” said Carter Schoenberg, VP and chief cybersecurity officer at SoundWay.

Source: SoundWay

If you enjoyed this article, please consider becoming a paid subscriber. Your support helps keep our site ad-free.

The post SoundWay Consulting named C3PAO appeared first on Intelligence Community News.

Naval Information Warfare Systems Command (NAVWAR) in support of Project Overmatch is announcing an Industry Day. Project Overmatch will enable a Navy that swarms the sea, delivering synchronized lethal and non-lethal effects from near-and-far, every axis and every domain. Critical to Overmatch is the development of networks, infrastructure, data architecture, tools and analysts that support the operational and developmental environment that will enable sustained U.S. maritime dominance.

NAVWAR invites interested companies a Classified Overmatch Industry Day held at the National Geospatial-Intelligence Agency on 17 June 2021. The Overmatch Industry Day is a forum for Industry Partners to learn about the project’s vision, the technological current state, and the challenges and opportunities that would benefit from private sector support.

Interested participants are required to pre-register via https://einvitations.afit.edu/inv/anim.cfm?i=599181&k=07684B087356. Registration will open at 0800 PST on 13 May 2021 and will close at 1600 PST on 31 May 2021. Each attendee is required to register individually.

Participation will be in-person limited to one (1) individual representative per company due to space limitations and COVID-19 safety protocols. One (1) alternate is highly encouraged to register in case the primary representative is unable to attend. There will be more than one event held the same day. Each event is approximately one hour and is exactly the same brief as held on 15 December 2020 in San Diego, CA. This event is mission essential and all COVID procedures will be enforced.

Full information is available here.

Source: SAM

The post NAVWAR announces Overmatch industry day appeared first on Intelligence Community News.

SITE III is DIA’s third consecutive Indefinite Delivery/Indefinite Quantity (IDIQ) contract to address the evolving information technology (IT) requirements vital to the security of the United States. The contract facilitates worldwide coverage for integrated IT intelligence requirements and technical support services to the DIA and National Geospatial-Intelligence Agency (NGA).

“DIA’s decision to award Leidos the SITE III contract represents their trust in our IT prowess and our proven success securing sensitive assets and critical infrastructure, systems and applications,” said Leidos Intelligence Group President Vicki Schmanske.  “Our customers are constantly faced with unrelenting threats and adversaries, and this award allows us to help combat these threats.  We’re proud to continue our support of DIA and the agency’s national security missions at home and around the world.”

The SITE III IDIQ contract provides a centralized and synchronized IT acquisition capability to meet worldwide security requirements and technical support services. Leidos will support this effort through system design, development, fielding and sustainment of global intelligence and command and control assets.

Source: Leidos

The post Leidos wins DIA SITE III spot appeared first on Intelligence Community News.

Supply chain security is one of the Cybersecurity and Infrastructure Security Agency’s (CISA) top priorities—a priority that it achieved largely through the collective effort of the ICT Supply Chain Risk Management (SCRM) Task Force. Co-chaired by CISA’s National Risk Management Center and the IT and Communications Sector Coordinating Councils (SCC), the Task Force is a public-private partnership that brings subject matter experts and representatives from more than forty small to large organizations together to collectively manage supply chain risks.

In January 2021, a six-month extension to the Task Force’s charter was signed, which will allow the Task Force to continue to launch new or updated lines of effort; start piloting its products within the ICT community and other stakeholders; and build relationships with international partners, sectors, and new stakeholders. Efforts over the next six months will include work by the:

• Information Sharing Working Group: Since vulnerabilities in the ICT supply chain could affect all users of that technology, organizations that share or receive suspect-supplier information early on in the acquisition process can prevent the collateral damage to users as well as all involved entities. Continuing the Task Force’s work, this WG will steer its focus on proposing paths, such as long-term policy and legal changes, that will give liability protection to the private sector in order to promote information sharing about suspect suppliers.
• Small and Midsized Businesses (SMB) Working Group: SMBs play a significant role in our nation’s economy and are at the heart of many industries, such as manufacturing. However, many SMBs may find it difficult to institutionalize Federal Supply Chain guidance due to limited finances, resources, and employees. This new WG will engage the SMB community to understand their needs and tailor Task Force products to make them more applicable to SMBs.
• Product Use Acceleration Working Group: Accelerating the applicability and utilization of Task Force products will help organizations manage impacts of supply chain risks. This new WG will engage with government agencies; state, local, territorial, and tribal entities; academia (i.e., Centers of Excellence); and non-governmental entities on how to apply Task Force products in their businesses, pilot specific products to test their usability, and incorporate feedback to ensure products continue to be useful and provide meaningful information.
• Study Group on Lessons Learned from Recent Software Supply Chain Attacks: As cyber attacks become more sophisticated, the roles of the chief information officer (CIO), chief information security officer (CISO), and IT or cyber security personnel are essential for safeguarding an organization’s information and assets. This study will dive into how the Task Force can support CIOs, CISOs, and other security personnel in making better risk-informed decisions when procuring or deploying certain ICT products—especially ones with high-level administrative access across an organization.

Over the course of the next several months, the Task Force will also proactively look at future activities and products that can help organizations and agencies respond to shifts in the global ICT threat landscape. Effective risk management depends on a unity of effort—a unity that the Task Force brings to its goal of achieving a globally secure and resilient ICT supply chain.

Source: CISA

The post CISA task force looks at ICT supply chain appeared first on Intelligence Community News.

MCIA is seeking information for potential sources for geospatial support services to be provided by the Contractor to perform integration and dissemination of geospatial information and intelligence products. Assist in providing enhancements and technical support specifically to the MCIA’s Geospatial Support Services (GSS) section to provide a “one-stop shop” for data discovery, downloading, and sharing intelligence information on unclassified, Secret Internet Protocol Router Network (SIPRNET), and Joint Worldwide Intelligence Communications System (JWICS) network domains. The requirements that have been levied upon the MCIA will also include the continued development of an online portal and support to user troubleshooting, instruction, and product development capabilities.

As a component, service level intelligence center, the MCIA has a responsibility to provide data, products, and information to a wide array of military, Department of Defense (DoD), and Intelligence Community (IC) customers. Geospatial information requires a normalized and well understood architecture, with a skilled dissemination approach to ensure the widest possible delivery to the Operational Forces in a sustained and timely manner. In addition to MCIA’s existing dissemination requirements, the Director of Intelligence (DIRINT), Headquarters, U.S. Marine Corps, has designated MCIA as the center-point for the Marine Corps Intelligence, Surveillance, and Reconnaissance Enterprise (MCISRE) which requires a robust enterprise. Included in that enterprise is an expected geospatial support requirement which will build upon what the MCIA has already developed.  MCIA experienced requirement quantity growth under the previous period and this may be the case in the future.

Full information is available here.

Source: SAM

The post MCIA seeks geospatial support appeared first on Intelligence Community News.

CACI will provide the mission expertise to PEO Soldier’s Project Manager Soldier Maneuver and Precision Targeting (PM SMPT) and Project Manager Integrated Visual Augmentation Systems (PM IVAS) to maximize soldier lethality, mobility, and situational awareness. That includes developing and conducting new equipment training, as well as providing rapid field service support for a wide-range of systems, such as the Integrated Visual Augmentation System, Thermal Weapon Sight, Enhanced Night Vision Goggles, Lightweight Laser Designator Rangefinder, and other soldier-borne systems that use imaging and laser technologies.

John Mengucci, CACI president and chief executive officer, said, “CACI is prepared to provide the Army with the expertise it needs to complete its missions overseas and minimize the risks to its soldiers. Additionally, this work further underscores CACI’s position as a leading mission integrator for the U.S. military.”

CACI Executive Chairman and Chairman of the Board Dr. J.P. (Jack) London, said, “CACI is proud to support the Army’s mission to deploy, fight, and safeguard our nation. Our work with the Army will always reflect CACI’s culture of character, ethics, and integrity.”

Source: CACI

The post CACI secures $128M US Army visual tech order appeared first on Intelligence Community News.

“Geospark Analytics is proud to partner with the DHS to bring them next generation capabilities,” said Geospark Analytics CEO and Founder Omar Balkissoon. “We are excited to work with them to implement and develop innovative technologies that will advance national security.”

According to the company, Hyperion is an immediate and substantial force multiplier for DHS, shifting the understanding of issues from a response to current risks to one that is a forecast of the future. In near real-time, Hyperion’s AI engine continually analyzes streaming publicly available information across the globe, identifies anomalies in activity levels, assesses stability and forecast future risk to stability for every country, over 1,100 cities and over 8,000 regions covering the entire globe.

Source: Geospark Analytics

The post DHS chooses Geospark Analytics for AI-driven risk assessment platform appeared first on Intelligence Community News.