By Grace LewisPrincipal Investigator, Edge-Enabled Tactical SystemsSoftware Solutions Division - Advanced Mobile Systems (AMS) Initiative Soldiers in battle or emergency workers responding to a disaster often find themselves in environments with limited computing resources, rapidly-changing mission requirements, high levels of stress, and limited connectivity, which are often referred to as "tactical edge environments." These types of scenarios make it hard to use mobile software applications that would be of value to a soldier or emergency personnel, including speech and image recognition, natural language processing, and situational awareness, since these computation-intensive tasks take a heavy toll on a mobile device’s battery power and computing resources. As part of the Advanced Mobile Systems Initiative at the Carnegie Mellon University Software Engineering Institute (SEI), my research has focused on cyber foraging, which uses discoverable, forward-deployed servers to extend the capabilities of mobile devices by offloading expensive (battery draining) computations to more powerful resources that can be accessed in the cloud, or for staging data particular to a mission. This blog post is the latest installment in a series on how my research uses tactical cloudlets as a strategy for providing infrastructure to support computation offload and data staging at the tactical edge. Cloudlet-Based Cyber Foraging Our research—in addition to myself, the team of research includes Sebastian Echeverria, Soumya Simanta, Ben Bradshaw, and James Root—focuses on cloudlet-based cyber foraging. Cloudlets, a concept created by Mahadev Satyanarayanan (Satya) of Carnegie Mellon University’s School of Computer Science, are discoverable, generic, stateless servers located in single-hop proximity of mobile devices. Cloudlets can operate in disconnected mode, which means that communication with the central core is only needed for provisioning. They are also virtual-machine (VM) based, which means that they promote flexibility and mobility, a perfect match for edge environments. Cyber foraging involves dynamically augmenting the computing resources of resource-limited mobile devices by exploiting a fixed computing infrastructure in close proximity. Cyber-foraging allows mobile users to offload computationally-expensive processing (such as face recognition, language translation, speech and image recognition) from a mobile device onto more powerful servers, thereby preserving device battery power and enabling more powerful computing. These capabilities are valuable for soldiers or emergency workers who often operate in tactical edge environments where these resource-intensive applications must be deployed reliably and quickly. As described in our paper that we recently presented at MilCom2014 (We will update the link when it becomes available), Tactical Cloudlets: Moving Cloud Computing to the Edge, we created the following five different ways of doing cloudlet provisioning: In optimized VM synthesis—described in our first blog post in this series, Cloud Computing for the Battlefield—the cloudlet is provisioned from the mobile device at runtime. VM synthesis involves large application overlay files, which can be costly to transfer in terms of battery and network bandwidth consumption in mobile and edge environments. The application overlay is built offline and corresponds to the binary difference between a base VM and that VM after the server portion of an application is installed. After the VM overlay has been transferred, it is applied to the base VM. The result is a complete VM that is running the server portion of the application that is executed from a client running on a mobile device. Due to the large size of the application overlay files, the battery and network bandwidth consumption proved too expensive for mobile and edge environments. As an alternative, we started looking at application virtualization as a possible solution to this problem. In Application Virtualization—described in our second blog post, Application Virtualization for Cloudlet-Based Cyber Foraging at the Edge—the cloudlet is also provisioned from the mobile device at runtime. Application virtualization uses an approach similar to operating system (OS) virtualization, by tricking the software into interacting with a virtual rather than the actual environment. A runtime component intercepts all system calls from an application and redirects these to resources inside the virtualized application. The virtualized application that is sent from the mobile device to the cloudlet at runtime is much smaller than an application overlay, but still large for transfer in edge environments. In Cached VM, the cloudlet is pre-provisioned with service VMs that correspond to mission-specific capabilities that match the client apps on the mobile device. Each service VM has a unique service identifier. In Cloudlet Push, the cloudlet is not only pre-provisioned with service VMs for mission-specific capabilities, but also the corresponding mobile client apps. At runtime, the cloudlet client obtains a list of available applications on the cloudlet, similar to accessing an app store. It then checks if the selected application exists for the mobile device’s OS. If so, the cloudlet client receives the app and installs it on the mobile device while the cloudlet server starts the corresponding service VM. In On-Demand VM Provisioning, a commercial cloud provisioning tool is used to assemble a service VM at runtime. In this case the cloudlet has access to all the elements for putting together a service VM based on a provisioning script. The experimental prototype uses Puppet, and the provisioning script is a manifest that is written in Puppet's declarative language. Over the last year, we ran several experiments to help us make a better decision on what we believe is the best cloudlet provisioning mechanism for the edge. We ultimately determined that Cached VM combined with Cloudlet Push, would be the most effective cloudlet provisioning mechanism because using both mechanisms enabled lower energy consumption on the mobile device placed less requirements on the mobile devices simplified provisioning in tactical environments An added advantage of combining Cached VM and Cloudlet Push is that if the mobile device already has the client app, it can simply invoke the matching service VM; if not, it can obtain the client app from the cloudlet (similar to accessing an app store) and then invoke the matching service VM. The tradeoff of this approach is that it relies on cloudlets that are pre-provisioned with server capabilities that might be needed for a particular mission. Another tradeoff is that the cloudlet is connected to the enterprise, even if just at deployment time, to obtain the capabilities. To understand how we reached this conclusion, it is important to examine the results of our experiments, which relied on three computation-intensive applications that are often relied upon by soldiers and emergency workers in tactical edge environments: facial recognition (FACE) speech recognition (SPEECH) object recognition (OBJECT) We used a Galaxy Nexus with Android 4.3 as a mobile device and a Core i7-3960x based server with 32 GB of RAM running Ubuntu 12.04 as the cloudlet. We created a self-contained wireless network (using Wi-Fi 802.11n at 2.4 GHz, 65 Mbps) to be able to isolate network traffic effects. Energy was measured using a power monitor from Monsoon Solutions. The results of our experiments are shown in Table I below. The first column under each mechanism is the size of the payload in MB that is sent from the mobile device to the cloudlet for provisioning. The second column is application-ready time, measured as the time in seconds from the start of the provisioning process until the cloudlet responds that it is ready. The third column in the energy consumed on the mobile device during application ready time. To understand how we reached the conclusion that a combination of cached VM and cloudlet push would be the best at tactical cloudlet provisioning, it is important to trace our logic, as well as the steps taken to reach our conclusion. As Column 1 in the table above illustrates, the problem with VM synthesis is the payload (referred to as the cargo of a data transmission) size, which is large. The payload size is large because the mobile device carries the computation that is going to be offloaded, which proved to be a problem for tactical edge environments. As many other researchers have noted—and as can be seen in Column 3 under VM synthesis—energy consumption has a linear correlation with the payload size. Communication typically consumes the most battery energy on a mobile device. From VM Synthesis we turned to Application Virtualization in the hopes that we could address the large payload size problem, which led us to ask, Could we package applications in such a way as to reduce the size of what is transferred from the mobile device to the cloudlet? Even though Application Virtualization significantly reduced the payload size (from 332 megabytes to 29 megabytes in object recognition) those payloads are still too large to be effective for soldiers in a hostile environment with limited resources and precious few seconds to spare. Under these types of constraints, it is important to ensure that the packaging is done correctly. If not, the application is not going to work. We took a step back and asked, In edge environments, with the soldiers and first responders that we are targeting, is it always the case that to offload computations, they have to carry the offloadable computation with them? To answer this question, our team of researchers next considered the Cached VM approach.  As part of our experiments we pre-previsioned cloudlets with computations that might be expected for a particular mission. This configuration would enable a soldier or first responder to inquire for cloudlets that already have the needed capabilities. While Cached VM significantly reduced the payload size (almost to zero) as well as application ready time and energy consumption, the approach still presents a problem if a soldier or emergency responder is not able to access a needed application as a result of a changing mission or circumstance.  We next experimented with Cloudlet Push. In doing so, we decided to not only pre-provision the cloudlet with service VMs that are needed for a particular mission, but also provision it with the corresponding software client applications for the mobile device, similar to an app store. With cloudlet push, the question asked by the soldier changes from Do you have this computation? to How can you help me? What computation do you have?  Next, we considered On-Demand Provisioning. To use this mechanism, we used a commercial cloud provisioning tool to assemble a service VM at runtime. In this case, the cloudlet has access to all of the elements to put together a service VM based on a provisioning script. Our implementation relied on Puppet and the provisioning script is a manifest that is written in Puppet’s declarative language. The benefits of On-Demand Provisioning include a small payload size, as well as a service VM that can be assembled at runtime. The drawbacks of this mechanism include a longer application-ready time. Also, the cloudlet needs to have all of the required server code components, or access to the components from enterprise repositories or code distribution sites. Overcoming these drawbacks led us to combine Cached VM and Cloudlet Push, which together consume less energy because the payload size is smaller, which in turn leads to shorter and more consistent application-ready times. Tactical Cloudlets: Future Research The next quality attribute that we will focus on in our research is trust, in particular trusted identities. For example  As a mobile device, is what I discovered really a friendly cloudlet?  As a cloudlet, did that offloading request really come from a friendly mobile device? Our current cloudlet implementation relies on the security provided by the network; that is, a mobile device is allowed to interact with a cloudlet according to network policies and permissions. This means that the cloudlet implementation is as secure as the network. While this may be acceptable in many domains, it is likely not enough for tactical environments. A key aspect of cloudlets is that they are discoverable. The cloudlet client that is installed on a cloudlet-enabled mobile device uses multicast DNS to query for cloudlets (set up as cloudlet services by the discovery service that runs on the cloudlet). Multicast DNS protocols are known to be insecure. However, securing the discovery process is not the problem because port scans or other probing methods can easily bypass discovery. A common solution for establishing trust between two nodes is to use a third-party, online trusted authority that validates the credentials of the requester or a certificate repository. The characteristics of tactical edge environments do not consistently provide access to that third-party authority or certificate repository, however, because they are disconnected, intermittent, limited (DIL) environments. Our future research will explore solutions for establishing trusted identities in disconnected environments. Even though the motivation comes from cloudlets, the goal is for the results to be applied to any form of trusted communication between two or more computing nodes. A review of related work shows that this is indeed a challenge, and there are many relevant and interesting ideas, but not very many concrete solutions. We welcome your feedback on our research. Please leave feedback in the comments section below. Additional Resources To register for an upcoming webinar on my research on tactical cloudlets, which will be held from 1:30 to 2:30 p.m. ET December 10, 2014, please visit this link. My previous research in this field focused on cloudlets provisioned using VM synthesis, which was described in the SEI technical note Cloud Computing at the Tactical Edge. To read this technical note, please visithttp://resources.sei.cmu.edu/library/asset-view.cfm?assetID=28021.

When the Carer’s Allowance Digital Service (CADS) project went through discovery (long before I joined the team), they were asked to build and iterate a first class customer facing service but also begin the transformation of the Carer’s Allowance digital ‘back office’ process. Work commenced on that transformation with the building of the Carer’s Allowance Staff Access (CASA) tool. CASA is a replacement for the twisting unseen ‘pipes’ that the digital transaction slips and slides its way through and a replacement for the big pool the transaction ends up in. Sounds fairly easy but it has been a long road. The CADS team has had to break new ground in many areas within the DWP to implement this new infrastructure. But anyway, onto some of the CASA benefits that the Carer’s Allowance Unit should see: - Automation of a data input task that previously took 6 hours a day to complete; this has been solved with 3 clicks of a button. CASA uses data, that the customer has input, to produce a summary sheet that staff previously had to manually complete. The layout of the system is easier for staff to navigate than the previous system. CASA is built to Government Digital Service and DWP accessibility standards The output used by Carer’s Allowance staff now has a more logical processing flow. Sounds like obvious stuff? Well, it kind of is. The beauty of CASA is that it’s not doing anything radical in terms of what it delivers, its meeting the needs of the Unit and staff. Previously the Unit has been restricted by the IT infrastructure it used, which meant that it couldn’t change any processes after the customer clicked submit on their digital transaction. Simply put, CASA makes the Carer’s Allowance digital processing simpler and faster, meaning they can focus on processing claims and making decisions quickly for customers of the digital service. The building of CASA has been driven by the Carer’s Allowance Unit requirements. The Carer’s Allowance staff have had direct input at every stage to shape and form how it will look and how they will interact with it. CASA went ‘Live’ on 21/10/2014. Just because the service has gone live, however, doesn’t mean the CADS team is done; the first release of CASA is the Minimal Viable Product. Work has already begun to iterate CASA with the help of the Carer’s Allowance staff and provide yet more improvements to processing digital claims which benefit the Carer’s Allowance Unit and its digital customers. Hopefully the work carried out by the CADS team will pave the way for other areas of DWP to transform its IT infrastructure.  

By C. Aaron CoisSoftware Engineering Team Lead CERT Cyber Security Solutions Directorate This post is the latest in a weekly series to help organizations implement DevOps.  Melvin Conway, an eminent computer scientist and programmer, create Conway’s Law, which states: Organizations that design systems are constrained to produce designs which are copies of the communication structures of these organizations. Thus, a company with frontend, backend, and database teams might lean heavily towards three-tier architectures. The structure of the application developed will be determined, in large part, by the communication structure of the organization developing it. In short, form is a product of communication.  Now, let’s look at the fundamental concept of Conway’s Law applied to the organization itself. The traditional-but-insufficient waterfall development process has defined a specific communication structure for our application: Developers hand off to the quality assurance (QA) team for testing, QA hands off to the operations (Ops) team for deployment. The communication defined by this non-Agile process reinforces our flawed organizational structures, uncovering another example of Conway’s Law: Organizational structure is a product of process. As the figure shown above illustrates, siloed organizational structures align with sequential processes, e.g., waterfall methodologies. The DevOps method of breaking down these silos to encourage free communication and constant collaboration is actually reinforcing Agile thinking. Seen in this light, DevOps is a natural evolution of Agile thinking, bringing operations and sustainment activities and staff into the Agile fold.  Every Thursday, the SEI Blog will publish a new blog post that will offer guidelines and practical advice to organizations seeking to adopt DevOps in practice. We welcome your feedback on this series, as well as suggestions for future content. Please leave feedback in the comments section below.  

You may be aware of the tragic passing of Dave Goldberg, husband of Facebook COO and anticipated SHRM15 keynote speaker Sheryl Sandberg. As might be expected, Sheryl is not able to join us in Las Vegas for our Annual Conference & Exposition. We extend our deepest condolences to Sheryl, and understand her need to be with family during this difficult time. In Ms. Sandberg's place, I am pleased to announce that New York Times bestselling author and Morning Joe cohost Mika Brzezinski will be speaking...

Most people claiming Carer’s Allowance go online instead of asking for a form to be posted to them. That’s because we’ve made a digital service that really is simpler, clearer and faster than putting pen to paper. Over a third of our digital claims are being completed on tablets and mobile phones - our service works on any device so people can apply for Carer’s Allowance when it’s convenient for them. So far, so good, but brilliant digital is a walk towards the horizon, not a climb to a mountaintop. We’re constantly researching and testing with real users, taking what we learn to change and improve the service. We also know that no matter how good the digital service is, some people will continue to need help and support to use it. Supporting our customers The standard of customer service at the Preston-based Carer’s Allowance Unit is recognized as exceptional, and that’s a great starting point for supporting those who would otherwise find a digital service difficult. There’s never been a ‘claim by phone’ option but the Carer’s Allowance Unit has always provided great telephone support to its customers for new claims, changes of circumstance and general advice about the benefit. We’ll continue to do this as the first part of our assisted digital service. Many people just need the answer to a simple question or guidance on how to describe their personal circumstances. Others may need more, so we’re researching to find out if there are user needs that we haven’t yet seen evidence of, rather than a one size fits all service. Finding out which kind of help people need When a customer calls and asks for a paper claim form, we always suggest using the digital service. If the caller says they don’t want to, or can’t go online to claim, we ask a few more questions to find out if they could do it with some help. From there we can provide advice on where to get web access or face-to-face support. This means that we’re not turning anyone away from the digital service. For ‘real-world’ support, we’re piloting using DWP’s huge network of Jobcentre Plus offices as drop-in locations for both internet access and personal support. To strengthen this option further, we’re establishing a network of Carer’s Allowance experts in the Jobcentres. Like the digital service we’ll need to learn and iterate to get this right. Owning the whole service I’m responsible for the entire Carer’s Allowance Service. For me, this means that the digital components are key to me maintaining our high standards and, of course, making the unit more efficient. We’ve embraced the digital service as part of the core Carer’s Allowance business - it isn’t just a separate function that plugs into the unit. We’ve been able to do this because the team that writes the code, designs the interactions and does the research works right here in the same building, as part of the same business. Like we say very proudly in the footer of the digital service "Carer’s Allowance - made in Preston". Because the digital service is ‘ours’, the contact-centre staff - again, all working here, in the same office in Preston - are confident about telling users that it’s the best way to make a claim. They’re also able to influence changes and improvements. This all helps make the service more useful and usable for customers and helps staff work more efficiently. The Carer’s Allowance digital service is ours, we’re proud of what we’re continuing to build, passionate about promoting it and committed to making sure everyone can use it.

By Nader MehravariSenior Member of the Technical StaffCERT Cyber Risk Management Team This blog post was co-authored by Julia Allen and Pamela Curtis.  Earlier this month, the U.S. Postal Service reported that hackers broke into their computer system and stole data records associated with 2.9 million customers and 750,000 employees and retirees, according to reports on the breach. In the JP Morgan Chase cyber breach earlier this year, it was reported that hackers stole the personal data of 76 million households as well as information from approximately 8 million small businesses. This breach and other recent thefts of data from Adobe (152 million records), EBay (145 million records), and The Home Depot (56 million records) highlight a fundamental shift in the economic and operational environment, with data at the heart of today’s information economy. In this new economy, it is vital for organizations to evolve the manner in which they manage and secure information. Ninety percent of the data that is processed, stored, disseminated, and consumed in the world today was created in the past two years. Organizations are increasingly creating, collecting, and analyzing data on everything (as exemplified in the growth of big data analytics). While this trend produces great benefits to businesses, it introduces new security, safety, and privacy challenges in protecting the data and controlling its appropriate use. In this blog post, I will discuss the challenges that organizations face in this new economy, define the concept of information resilience, and explore the body of knowledge associated with the CERT Resilience Management Model (CERT-RMM) as a means for helping organizations protect and sustain vital information. A New Information Economy The information economy is transforming every public and private sector, including the way we deliver healthcare and educational services, fight wars and provide national security, design and operate critical infrastructure, build cities and communities, and manufacture goods. The following are some characteristics of the current environment that indicate we now operate in an information economy: Intangible goods (e.g., information, ideas, and intellectual assets) continue to increase in absolute value and relative volume. This trend is apparent from the fact that the market capitalization of the largest entities in the world is increasingly based on the value of their information assets (e.g., customer records patient information, intellectual property, trade secrets, consumer purchasing and browsing data, new product specifications), and not solely their physical assets (e.g., land, buildings, equipment, and raw material). For businesses, information has moved from a supporting role to a leading role in determining mission success to the point that information is now among the highest valued assets, products, and services. It is almost as if the bits that make up the information are more important than the atoms that make up the infrastructure and the environment that the information resides in. Physical and cyber (i.e., virtual) worlds are increasingly intertwining, and their boundaries have blurred. This change is reflected in the fact that virtual goods and environments are replacing their physical counterparts (e.g., virtual grocery store coupons; virtual business parks; virtual ballot box; virtual offices; virtual jobs; virtual stock markets; virtual water coolers such as cloud-based collaboration tools, online chat groups, and other types of social media). Even bank robberies are virtual, and can be instigated from a different continent. People (the initial users of the Internet), businesses (the next generation of Internet users in the form of eCommerce), and things (in the sense of the Internet of Things) are converging into a ubiquitous evolutionary information marketplace. Content (i.e., information) developers and owners are the kings, not the equipment manufacturers (on whose systems the content is viewed) or the communication service providers (through which the content is delivered). Immediacy is valued more than thoughtfulness, correctness, and the absence of defects. Technological advancements are developed and put into practice at a speed that makes them inherently unpredictable and often disruptive. Every innovation comes with flaws that someone will eventually exploit for personal gain. This technological whirlwind has thus spawned an ever expanding and dynamic operational risk environment. Evolving in the Risk Environment One of the primary success factors in the information economy is the manner in which organizations protect their information assets while operating in a volatile risk environment. Traditional IT security has been the underpinning of e-commerce. Without it, businesses and consumers would not have had the trust and confidence to use the Internet. For organizations to survive and thrive in today’s information economy, however, they must manage risks to information assets in terms of all forms of technology that create, process, store, disseminate, and consume information, They include conventional information technologies, the ever-changing operational technology (OT), such as industrial control systems, physical access control mechanisms, etc., as well as the rapidly evolving and expanding Internet of Things (IoT). Traditional IT security has focused on the management of security risks within an organization’s enterprise IT environment, often performed by an IT security organization. Meanwhile, separate teams manage risk associated with other forms of technology, such as operational technologies (OT) that monitor and control physical devices and processes (e.g., industrial control systems) and where non-IT work processes are involved. With the blurring of boundaries in the information economy, organizations must consider risk assessment and management across all forms of technology and assets. A more consistent and unified approach to information risk management will result in  increased confidence and greater assurance that realized risk will not affect an organization’s ability to achieve its business mission. Moreover, risks associated with various forms of technology are only one dimension of operational risk in today’s information economy. Proper protection and sustainment of information assets must go beyond technology-focused risk management activities. Traditional concepts of IT security (and the closely associated concepts of information security, information assurance, and cybersecurity) must evolve beyond their current technology scopes and be augmented by techniques and concepts from such domains as physical security (of tangible assets), safety (of people assets), and privacy (of personal information). Information Resilience The next step for organizations to consider is information resilience, which we define as the ability to protect and sustain critical information assets throughout their entire lifecycle (whether they are being created, processed, stored, disseminated, or destroyed) regardless of where such assets physically reside at any point in their lifecycle. In addition to preventing and defending against disruptions to technologies, information resilience emphasizes response and continuity during times of stress across technologies, people, and facilities. Information resilience is concerned with information assets in two separate but interrelated dimensions: lifecycle dimension - the stages of information creation, processing, storage, dissemination, and destruction (where some of the stages may take place in different order and/or in parallel) containment dimension - the containment of information in technology, people, and/or facility assets at any point in its lifecycle Information resilience addresses the entire operational risk landscape for information assets that are critical for enabling the organization’s mission success in the information economy. Protection and sustainment considerations, therefore, apply to information assets in every aspect and intersection of these dimensions. Given the proliferation of data typical in the information economy, information assets must be prioritized. For example, critical information assets may be those that are used in mission-critical services, information entrusted to the business by others, intellectual property, or information essential to operation of the business, such as vital records and contracts. Identifying critical assets makes all other information resilience practices feasible. Profiles can be created for critical information assets to specify their confidentiality, availability, integrity, custody, privacy, sensitivity, and acceptable use requirements (collectively, resilience requirements). They can also be used to characterize the individuals (e.g., employees, suppliers, customers, contractors, regulators) who have access to them, containers (e.g., people, devices, facilities) on which the information resides, the units (e.g., systems, applications, brains) in which it is processed, and the environment (e.g., electronic networks, transportation infrastructure) over which it may be transferred.  Satisfying the resilience requirements of critical information assets requires continuous risk management (i.e., identifying risks whenever and wherever information assets are created, stored, transported, and processed, assigning dispositions to risks, and mitigating or otherwise handling risks). Administrative, technical, and physical protection controls must be applied as appropriate to meet resilience requirements. Configuration control should be used to establish baselines and point-in-time captures of information assets. Methods for Managing Information Resilience Approaches for assessing, improving, and managing information resilience could be ad hoc or based on some structured methodology. Information resilience requires involvement and contributions from such domains as IT, OT, IoT, physical security, safety, and privacy. Therefore, an ad hoc approach will likely not produce the desired and sustainable results. Efforts to assess, improve, and manage information resilience should be based on proven and structured approaches that provide repeatable, predictable, high-quality outcomes. Use of such comprehensive and flexible frameworks as the CERT Resilience Management Model (CERT-RMM)  and the associated body of knowledge can help in achieving a sustainable capability. There are many effective and appropriate ways for an organization to use CERT-RMM to guide, inform, or otherwise support improvements to its information resilience management activities. For those familiar with the concept of process improvement, CERT-RMM can be used as the body of knowledge that supports model-based process improvement activities for information resilience management principles and practices. Alternatively, a targeted improvement roadmap (which is a term used to designate a specific collection of CERT-RMM domains that a collectively address a specific objective), has been defined to assist organizations in planning and guiding their journey towards enterprise-wide information resilience. Benefits of using such structured frameworks include enabling native incorporation of operational risk management principles and practices into the organization’s cultural norm or DNA ( i.e., it is integrated into the normal course of rhythm of the business) ensuring that risk-based activities align with organizational risk tolerances and appetite serving as the starting point for socializing important harmonization and convergence principles across IT, OT, IoT, physical security, privacy, etc. facilitating collaboration between activities that have similar operational risk management objectives maintaining a business mission focus improving confidence in how an organization responds in times of operational stress enabling measurements of effectiveness enabling institutionalization and culture change guiding improvement in areas where an organization’s capability does not equal its desired state Cost-Benefit Issues Several issues should be considered if an organization wants to maximize the value of adopting an information resilience approach. First, the need to protect information assets must be continually balanced with the need to run the business. Second, an objective of total prevention of disruptive events that negatively affect information assets (e.g., cyber-attacks) is not practical. And third, treating all risks and all information assets equally is not cost effective. The most important information assets must be identified and the protection and sustainment measures related to them prioritized. Looking Ahead Today’s information economy has reshaped the organizations, industries, and communities that we are part of, creating new technological capabilities and business opportunities while blurring digital and physical worlds. At the same time, however, it has created new security challenges that feed an ever more dynamic and expanding risk environment that is simply beyond the scope of a traditional IT security function. A more consistent and unified approach to information risk management will result in increased confidence and greater assurance that realized risk will not affect an organization’s ability to achieve its business mission. Information resilience is such an approach. It is a more overarching, and manageable, concept that promises to be a key tool in our tool box of techniques for protecting and sustaining organizations’ critical information assets and associated dependent business products, services, and missions. It is a critical dimension of operational resilience as defined by CERT-RMM, which, in addition to information asset resilience, addresses the resilience of technology, people, and facility assets. Additional Resources For more information about CERT’s Resilience Management Model (CERT-RMM) http://www.cert.org/resilience/products-services/cert-rmm/ https://www.csiac.org/spruce/resources/ref_documents/recommended-practices-managing-operational-resilience For more information about information economy and related transformations https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/206944/13-901-information-economy-strategy.pdf http://www.gartner.com/technology/research/digital-business/ http://www.forbes.com/sites/gartnergroup/2014/05/07/digital-business-is-everyones-business/ http://fortune.com/2014/02/27/box-ceo-how-will-your-company-compete-in-the-information-economy/ http://mitsloan.mit.edu/ide/  

  The recent announcement about Sheryl Sandberg being unable to join us in Las Vegas at SHRM’s Annual Conference is no doubt disappointing to a lot of people - myself included. But at the same time who can fault her for wanting to and needing to be with her family during this difficult time. I have been reading a lot about the sudden passing of her husband, Dave Goldberg and it got me thinking about a lot of things. First the outpouring of condolences, thoughts and prayers from so many people that Sheryl and Dave both knew and did not...

It has been about 6 months since we started to build the Business Design community at DWP. Some of our community are already finding that being able to operate in these roles is a great way  to develop their career.  When we set up our Business Transformation group we recognised that DWP needed to build the great digital services that customers expect from government, but equally that we had to make a step change in the way the core of the business operates. Creating a joined-up business design is a critical part of building a more modern and efficient DWP, with customers at the heart of our thinking. We brought together the Business Design community to join up across the delivery programmes within the department, and this team has been co-creating the blueprint for the department. To get the design work moving quickly, we wanted to follow a recognised approach rather than re-invent any wheels. We supplemented the established DWP teams with a small number of experienced business designers from outside the department. In the longer term we want to build a sustainable function within the department, so we will be transferring knowledge and upskilling our teams. The skills we need fall into two broad areas: Consultancy skills - building our skills in understanding problems and influencing stakeholders like our in-flight change programmes. Technical design skills - building a "tool bag" of techniques to design the business. We’re working on both areas but for this blog wanted to focus on some useful technical design skills for the designers/architects operating at various different levels in DWP.  We selected the following tools to explore in our Business Design Academy: One-Page Strategy - seeking the answers to a series of key questions and presenting it on one page. Andrew Campbell’s "9 tests" of Organisation Design - expose unavoidable trade-offs and assess the advantages and disadvantages of different designs. Organisation charting techniques - describing the relationships between different types of organisation units. Business Capability mapping - showing  individual business capabilities in relationship to each other, enabling us to see the larger context and align across our people, technology and processes. Design Principles - building a link from our  business strategy into ‘rules’ that will guide design decisions.  For DWP our design principles will follow our Guiding Principles for business transformation. DWP Business Transformation - Guiding Principles Customer Segmentation Models - dividing customers into groups based into distinct needs so that they can be treated in similar ways. We’ve had lots of interest in building our tools and techniques for business design, and some of our community have already shown that being able to operate in these roles is emerging as a great way to develop their career. Follow Andrew on Twitter and don’t forget to sign up for email alerts.

By Todd WaitsProject LeadCERT Cyber Security Solutions Directorate This post is the latest in a series to help organizations implement DevOps. In a previous post, we defined DevOps as ensuring collaboration and integration of operations and development teams through the shared goal of delivering business value. Typically, when we envision DevOps implemented in an organization, we imagine a well-oiled machine that automates  infrastructure provisioning code testing  application deployment  Ultimately, these practices are a result of applying DevOps methods and tools. DevOps works for all sizes, from a team of one to an enterprise organization. DevOps can be seen as an extension of an Agile methodology. It requires all the knowledge and skills necessary to take a project from inception through sustainment to be contained within a dedicated project team. Organizational silos must be broken down. Only then can project risk be effectively mitigated. While DevOps is not, strictly speaking, continuous integration, delivery, or deployment, DevOps practices do enable a team to achieve the level of coordination and understanding necessary to automate infrastructure, testing, and deployment. In particular, DevOps provides organizations a way to ensure collaboration between project team roles infrastructure as code automation of tasks, processes, and workflows monitoring of applications and infrastructure Business value drives DevOps development. Without a DevOps mindset, organizations often find their operations, development, and testing teams working toward short-sighted incentives of creating their infrastructure, test suites, or product increment. Once an organization breaks down the silos and integrates these areas of expertise, it can focus on working together toward the common, fundamental goal of delivering business value. Well-organized teams will find (or create) tools and techniques to enable DevOps practices in their organizations. Every organization is different and has different needs that must be met. The crux of DevOps, though, is not a killer tool or script, but a culture of collaboration and an ultimate commitment to deliver value. Every Thursday, the SEI will publish a new blog post that offers guidelines and practical advice to organizations seeking to adopt DevOps in practice. We welcome your feedback on this series, as well as suggestions for future content. Please leave feedback in the comments section below.

We had a lot of interest in our blog about building our Business Design skills at DWP. We’ve recognised that working towards a joined-up business design - a clear description of our future customer proposition and the way we’ll organise ourselves to deliver it - will be critical to realising our transformation ambition. Joining up like this across our people, technology and processes is challenging for the Department, and so we have had to quickly build our capability to design the business. We need great people, and we’ve been developing our own people, recruiting, and hiring on an interim basis. A community across DWP Designers and architects are operating in many different areas around DWP. This year we have formalised within our transformation group a departmental Business Design team, which includes some of our Business Designers, and a Business Architecture Services team. And there are many related roles around the rest of DWP, for example in our technology organisation, major change programmes, and in operations.  All these people need to share an understanding of our transformation ambitions. Business Designers from around DWP But what kind of person are we finding makes a great Business Designer? What do we look for in a Business Designer? Business transformation advocate - Act as an "ambassador" for our transformation journey; tell a compelling story of our future vision which engages our stakeholders. Get feedback and build it into our transformation story. Strategically aware - Understand the unique purpose of DWP, its financial responsibilities, and its strategic goals. Apply strategic thinking and understand the detail. See the potential of business models and digital opportunities from the outside world, and use this knowledge to challenge DWP to deliver even better services. Desiger and developer of content - Bring designs together in our transformation roadmap; understand and shape design deliverables. Use business and technical understanding to align product and technology roadmaps. Understand our change lifecycle. Be able to use a wide range of tools and techniques to arrive at a consistent business designs, with the minimum effort required; recognise when to bring in experts. Problem solver and creative thinker - Blend analytical, critical and creative thinking; help business areas identify and work through difficult design choices and build consensus around solutions; work with different specialisms in multi-disciplinary teams; challenge constrained thinking. Communicator - Engage and relate to different audiences; communicate upwards, downwards and outwards; comfortable working with people at all levels within DWP; explain complex messages in an accessible way. "Do the hard work to make it simple." Flexible - Adapt our tools and frameworks where necessary. "If it works, do it. If it doesn’t, don’t". It’s hard to find great people who can be all these things. But DWP can offer a compelling environment for those who can rise to the challenge. Ultimately we’re looking for designers of great user experiences (which put people at the heart of our services), and designers of operating models (which form the basis of a modern DWP). Our job is to create something new, efiicient and exciting, not just to create a slightly better version of the same organisation. After all, we’re part of the best digital startup in the country!   If you’re interested in joining us, all of our permanent roles are on Civil Service Jobs, and don’t forget to follow @DigitalDWP on Twitter for announcements and updates. Keep in touch by following Andrew @abesford on Twitter.