Web extra: Bartock, Bird, Heitkamp: The value of collaboration

This team of experts views IT challenges in three dimensions

The federal government's now-mandatory security configuration standard for Microsoft Windows XP and Vista, known as the Federal Desktop Core Configuration, can greatly improve federal information security because three people saw a way to make it work.


One of them was Kenneth Heitkamp, associate director of life cycle management at the Air Force's Office of the Chief Information Officer. Heitkamp had to show evidence to Karen Evans, administrator for e-government and information technology at the Office of Management and Budget, that a standard security configuration was feasible. Evans lives in West Virginia, but she often acts like a native of the Show Me state. "Karen Evans was from Missouri on this one," Heitkamp said.


Evans wanted proof that a standard security configuration for Windows that had worked for the Air Force would satisfy the other military services' needs before expanding it governmentwide.


"Once we got all four services to agree, it gave her the model house that other federal agencies could look at," Heitkamp said.


Heitkamp's success at leading the Air Force to adopt a standard Windows security configuration became the foundation for what many experts say is potentially the most effective security policy that the government has adopted. 


"This was not easy," said Tony Sager, chief of the National Security Agency's Vulnerability and Operations Group. "If it was, people would have done it in the past. There is a lot of operational pain with tighter security, which makes this very challenging."


The Air Force provided compelling evidence, but Evans asked for more. She sought the advice of Paul Bartock, NSA's technical director for network operational vulnerabilities, and Shelly Bird, chief architect at Microsoft Consulting Services.


"Ken's leadership and commitment to making the federal government a safer environment is to be commended," Evans said. "The Federal Desktop Core Configuration is truly a private/public partnership, and it was clearly demonstrated by the commitment of the team, which included Shelly and Paul. We are where we are today due to their efforts."


Bartock had hands-on experience with the core configuration at Defense Department sites, so he knew how the security settings could, in some cases, hinder normal operations.


"We had all this operational context and had a body of knowledge to make informed decisions," Bartock said. "We pulled vendors in at the end to get their input, which helped us leverage their security guides."


Bartock led NSA teams that went to sites to test the core configuration in operational environments. "We showed up at DOD sites, they said you recommended that and it broke this," he said. "We got feedback that was important."


Bartock applied that knowledge to making a case for which security settings the FDCC should include.


"The operational managers would say these security settings are impacting our applications, and we could argue that we need them for these reasons and let us find a countermeasure so the applications will work," Bartock said. "Now application developers have a clear understanding of what security must run against their software," he added.


Bird contributed to the FDCC as the leader of a team that developed group policies and virtual machines for agencies to test whether their applications would run with the standard security settings in place.


Bird also worked closely with OMB, the National Institute of Standards and Technology, NSA and the Defense Information Systems Agency to develop thousands of security settings in the desktop core configuration standard.


"The toughest part was figuring out how to translate the standard into something from Air Force that civilian agencies would accept," Bird said. "The challenge for NIST was to work its way through the baseline. We had a fairly lucky convergence of events, including the maturing of the Secure Content Automation Protocol program" for verifying that mandatory security settings have not changed.


Bird said SCAP brought necessary accountability to the program and helped persuade NIST to support it.


"We are simplifying what it takes to get this in place, and we are trying to make this implementation-oriented," Bird said. "What surprised a lot of people was the general response from agencies that 'This is great, and you will help us get through this.'"

Featured

  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

  • Census
    shutterstock image

    2020 Census to include citizenship question

    The Department of Commerce is breaking with recent practice and restoring a question about respondent citizenship last used in 1950, despite being urged not to by former Census directors and outside experts.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.