Beyond the Checkbox: How Continuous ATO Is Changing Federal Cybersecurity for Good

00:00 This FedGov Today program is sponsored by Synack. On this edition of FedGov Today with Francis Rose, the solution to avoiding a cookie cutter approach to authorities to operate. Looking at your environment, taking it for the uniqueness that it is, and then working with it, and in consideration of it to kinda build that ATO or CATO process. Dina Saleh on FedGov today in just a moment. The army will add more programs to the three that currently have continuous authorities to operate. The CIO of the army, Leo Garcia,

00:32 tells FedGovToday it's taken about two years to refine the CATO process. Dina Saleh is Federal Solutions architect at Synack. Dina, welcome. It's great to have you on the program. What difference have you seen the continuous authority to operate concept make for security across federal agencies? Welcome. Hi, Francis. It's a pleasure to be here. I think that's a great question. I think the most significant difference that I've seen just by, you know, being boots on the ground and talking to people and having these conversations is I think it's getting people excited again.

01:03 I think it's preventing people from falling into that kind of, you know, I like to call it that endless death loop of kind of being inundated with that process of the, you know, original ATO process that, you know, was a pain for anyone that was going through it. For those folks that haven't gone through it, count yourself lucky. You save yourself a few gray hairs, but it was definitely one of those really, you know, fatigue heavy processes. And now with continuous ATO, basically, we're redoing that whole that whole concept of very

01:36 static one dimensional old school procedures and processes. And so because we're now focusing on continuously monitoring, continuously testing, and continuously updating, it's gonna be a lot more efficient and we don't have to wait for every couple years to go ahead and test our solutions and our softwares to make sure they're they're remaining compliant and they're also remaining secure. You used that fatigue word before we went on the air when we're talking in the warm up, and I think that's a really interesting way to describe the way a lot of folks have thought about not

02:07 just the security process, but the overall software development process in general inside the federal government? What's driving that, and what are the potential solutions above and beyond the continuous authority to operate process? Well, I think, again, fatigue comes from that continuous kind of process. Right? It does mean nonstop. It means that you're, you know, you're collecting vulnerability data and scanning results and checking log reports twenty four seven.

02:37 And that also means that your teams have to manage that. Right? So they're usually, you know, the same ones that are trying to keep systems online. They're, you know, not only drowning in dashboards, they're fighting tool sprawl. And half the time, you know, the the systems they're monitoring weren't even built for this kind of visibility. Like, again, especially with legacy systems. I think that fatigue just feels incredibly overwhelming. And then a lot of times, they're inundated with just overwhelming data, and it's like they're drowning in it. And I think that's where Synack comes in because I like to

03:07 think of Synack and I always tell, you know, my my customers that it's kinda like we're the cheat sheet for the exam. Right? So, you know, you guys have got, like, pages and pages of security data, of scans, findings, and alerts. And then we come in, we're gonna strip all that down for you and actually focus on what matters. So we're gonna show you, you know, like, which questions are gonna be on the test, which answers count, and then which ones you can actually ignore. So instead of spending those countless hours buried in every single, you know, line of vulnerability data and reports, you're gonna get the right stuff that's

03:38 truly exploitable, it's verifiable and that needs attention now. And I think the biggest difference is we really focus on not just giving you data but providing direction or giving you direction. It sounds too like having all of that information is helpful and not helpful at the same time both in knowing what you have and knowing how secure you are, but also in meeting whatever the compliance rules are that you have to whatever those marks are that you have to hit. Definitely. No. That's that's a hundred percent true, and I think that's that's what everyone's trying to figure out.

04:09 Right? So, again, with continuous authorized to operate, I think it looks great on paper. Again, because you are continuously testing. You know, you have faster ATOs. You have more agility. It sounds simple in theory. But in reality, I don't see that, you know, usually being the case because, you know, most places still treat it like a one year thing. So I see teams, you know, pulling all nighters before an assessment. You know, those folks are scrambling to check, you know, to check boxes. And then after that, it's crickets, right, until the next cycle. And that's not necessarily continuous.

04:41 That's just that's just louder compliance. Yeah. And and that's the real problem is it's bandwidth. Right? People are gonna be people are likely burned out. Security teams are, you know, juggling audits. They're they're patching. They're, you know, ticketing queues. And they're also trying to keep the lights on. So you can't have true, you know, continuous if you're still chasing spreadsheets and firefighting every day. It's just like a classic trap that I see a lot of folks fall into. What is the role for artificial intelligence to automate some

05:11 of that ongoing data collection, data analysis, and then application? Definitely. So again, and I'm sure everyone has said this that AI is the shiny new thing right now. Right? So no doubt it's definitely useful. However, it is not a silver bullet. Right? You can't just slap AI on top of compliance or on top of a compliance stack and then call it continuous. And I've seen that happen more times than not, unfortunately. I think AI, you know, I think of it as like an intern who never sleeps. So, yes, it's gonna be doing the heavy lifting,

05:43 the repetitive, boring, cumbersome stuff so that humans can actually come in and focus on that nuance to work that nuance to work. And again, from a Synack perspective, we use AI and automation to, you know, surface those issues quickly, but we still put a human in in the loop to be a part of the process. So that way, we have a human coming in and deciding what is real, if it's able to be chained, and if it matters. Otherwise, it's just gonna be a lot of noise and not insight. What are the obstacles that you've seen organizations in

06:15 the government run into when they've tried to implement CATO process? Yeah. I I think, you know, apart from the whole compliance aspect of it, I feel like, you know, it's that a lot of their data is static. It's very one dimensional. And and, again, the reason for this is because your tools and those that automation process, it only knows what it knows. Right? It's only gonna look at a vulnerability and be like, is this exploitable? Yes or no? As a human, I bring in that insight.

06:47 And again, I was a former pen tester at DHS for a few years. I can look at a vulnerability and be like, you know what? It's gonna take me a couple hops to make this exploitable. And I think that's one of the the the biggest issues is because, you know, that human intuition really kind of is necessary to kinda close that security gap that a lot of, organizations are falling into. You mentioned AI is not a silver bullet. Are there people that are still approaching it like it is in the security space?

07:17 Very much so. Very much so. It's kind of like I actually had a general at one of the conferences tell me, like, I hate the word modernization. I hate the word because or in in zero trust because people just use this as a fancy word and they slap that on. They're like, hey. We're, you know, we're zero trust or we're using AI, and they think that's like a a cure for all. And if anything, it it buys them a peace of mind, but it doesn't take care of the issue. And then when something does happen, when something does break or, you know,

07:48 a a system is infiltrated, that's when they're like, you know, wait. How did I know AI is working, or how do I even validate that my zero trust is effective? That is an another loophole that I see a lot of industries fall into is they're assuming kind of blindly that these are effective and these are just go to methods without actually testing it and doing their their due diligence. Six or eight years ago, I was at a big, IT conference for the federal government, and I made a joke on stage that I wish that I had a

08:18 concession that made little stickers for people to stick the word cloud on their business cards, and I would make more money than anybody in the joint. And everybody laughed, and then everybody at the same time kinda went, like, they realized all of a sudden it wasn't quite that funny. And that's my sense of where we are right now with artificial intelligence. Absolutely. A hundred percent. I think it like I said, it it looks and it sounds nice, but I think actually putting it to the test, I don't see people doing that. And I think that's that's kind of where environments tend to

08:49 fall apart and security stacks tend tend to crumble. Is there a blueprint or a a list of best practices for establishing a successful CATO process inside an agency? I've mentioned the army at the beginning of our conversation that seems to be having some success in replicating it. Okay. We got one. Now we got three. Leo says they're gonna get more and so on. It sounds like they've kinda cracked the code to some degree. Is that something that's replicable across agencies,

09:19 or does everybody have to kinda figure it out on their own based on their infrastructure or their mission or whatever? That's that's that's kind of the issue is it's so easy to kind of look at it from a very cookie cutter approach. And and personally, in my experience, looking at it that way, it gets rid of the uniqueness that every single environment, every single, you know, agency has within the federal space. And and I think looking at it objectively is not always the way to go because, again, people have different processes. There's things that are updating different systems in place.

09:50 And so I think that is probably one of the biggest cruxes if you're looking at it from a one size fits all perspective. I think looking at your environment, taking it for the unique the uniqueness that it is and then working with it and in consideration of it to kinda build that ATO or CATO process. For example, like, customer one DOD customer in particular sticks out, you know, they've been dragging towards, you know you know, CATO forever. Like, they have tons of systems. They have lots of manual work.

10:20 And like I said before, their people were totally fatigued. But again, we kinda came in, we scaled the testing so it was able to run, you know, continuously across all their environments. And then the automation, perspective came in and we kinda handled coverage. So it was great. And then our researchers kinda further came in and then validated everything. So we reduced time because we're cutting out, you know, false positives. And so we're able to kind of produce a clean evidence of all their security packages. And, you know,

10:50 it ended up being effective and very successful and a very, very easy process as easy as it could as it could be. Yeah. Is there a foundation that an agency should have from an infrastructure perspective or a governance perspective or any of that to be able to get off on the right foot when it starts into something like this? Right. But, again, keep in mind that it is all so fluid right now just even given what the again, certain compliance checks, all these mandates that are coming out, it's it's so difficult to kinda look at it and just be like, I need to do these three things for me to kind of be on the

11:21 road to becoming keto ready. But it does require a lot more nuance. It instead of painting with a broad brush, you do need to go and become a little bit more narrow and just look at everything specifically to that to that agency. Dina, it's great to have you on the show. I appreciate your time today. Thank you. Pleasure. Thank you so much. You can read more about continuous ATOs on today's show page at Fed Gov Today dot com. Coming next on the Fed Gov Today podcast, avoiding shutdown surprises. The former CIO of the FBI, Gordon Bitko,

11:51 will tell you how tomorrow. If you don't wanna miss that, you can follow the FedGov Today podcast on Apple Podcast, Spotify, on the FedGov Today YouTube channel, or on demand at FedGov Today dot com. I'm Francis Rose. I'll talk to you then. Thanks for listening.